CVE-2021-27363: Linux Kernel Information Disclosure Flaw

CVE-2021-27363 Overview

CVE-2021-27363 is a kernel pointer leak vulnerability discovered in the Linux kernel through version 5.11.3. The vulnerability exists in the iSCSI subsystem where the transport's handle is exposed to unprivileged users via the sysfs file system. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle becomes accessible at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. Reading this file triggers the show_transport_handle function in drivers/scsi/scsi_transport_iscsi.c, which leaks the handle—a direct pointer to an iscsi_transport struct in the kernel module's global variables.

Critical Impact

This kernel pointer leak enables unprivileged local users to determine the address of the iscsi_transport structure, potentially facilitating address space layout randomization (ASLR) bypasses and assisting in further kernel exploitation chains.

Affected Products

• Linux Kernel (versions through 5.11.3)
• Debian Linux 9.0
• NetApp Cloud Backup
• NetApp SolidFire Baseboard Management Controller Firmware

Discovery Timeline

• 2021-03-07 - CVE-2021-27363 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-27363

Vulnerability Analysis

This Information Disclosure vulnerability affects the Linux kernel's iSCSI transport subsystem. The root issue lies in how the kernel exposes internal data structures through the sysfs interface. When an iSCSI transport driver registers itself with the kernel's iSCSI subsystem, a sysfs entry is automatically created that includes a handle attribute file. This file is world-readable by default, allowing any local user to read its contents.

The vulnerability occurs because the show_transport_handle function directly outputs the pointer value of the iscsi_transport structure without any sanitization or access control checks. This pointer leak defeats kernel ASLR protections by revealing the exact memory location of kernel data structures, which attackers can leverage to construct more sophisticated exploits targeting other kernel vulnerabilities.

Root Cause

The root cause is improper information exposure in the show_transport_handle function within drivers/scsi/scsi_transport_iscsi.c. The function returns the raw kernel pointer value of the iscsi_transport structure to userspace without validating caller privileges or masking the pointer. This design flaw allows unprivileged users to obtain sensitive kernel memory addresses by simply reading the sysfs file at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle.

Attack Vector

The attack vector is local, requiring the attacker to have unprivileged user access to the target system. Exploitation is straightforward:

1. The attacker identifies available iSCSI transports by listing /sys/class/iscsi_transport/
2. For each transport, the attacker reads the handle file (e.g., /sys/class/iscsi_transport/tcp/handle)
3. The kernel returns the raw pointer value of the iscsi_transport structure
4. The attacker uses this leaked address to calculate the base address of kernel modules or defeat ASLR protections

The leaked pointer can then be used as part of a multi-stage attack where the attacker chains this information disclosure with other kernel vulnerabilities to achieve privilege escalation or arbitrary code execution.

Detection Methods for CVE-2021-27363

Indicators of Compromise

• Unexpected read operations on /sys/class/iscsi_transport/*/handle files by non-root users
• Suspicious processes accessing iSCSI sysfs entries without legitimate storage administration purposes
• Unusual kernel exploitation attempts following pointer leak activity

Detection Strategies

• Monitor sysfs access patterns using auditd rules targeting /sys/class/iscsi_transport/ paths
• Implement file access monitoring for the handle attribute files under iSCSI transport entries
• Deploy kernel-level monitoring to detect suspicious patterns of kernel address leakage attempts

Monitoring Recommendations

• Configure audit rules to log all access to /sys/class/iscsi_transport/*/handle files
• Review system logs for unauthorized users attempting to enumerate iSCSI transport information
• Correlate pointer leak attempts with other suspicious kernel-related activity that may indicate exploitation chains

How to Mitigate CVE-2021-27363

Immediate Actions Required

• Update the Linux kernel to a patched version that addresses commit 688e8128b7a92df982709a4137ea4588d16f24aa
• Apply vendor-specific patches from Debian, NetApp, or your Linux distribution's security updates
• Restrict access to systems running vulnerable kernel versions to trusted users only

Patch Information

The Linux kernel maintainers have addressed this vulnerability in commit 688e8128b7a92df982709a4137ea4588d16f24aa. This commit modifies the show_transport_handle function to prevent the kernel pointer from being exposed to unprivileged users. Distribution-specific patches are available through:

• Debian LTS Security Announcement
• NetApp Security Advisory
• Kernel Live Patch from Packet Storm

Workarounds

• Restrict read permissions on /sys/class/iscsi_transport/*/handle files using file system ACLs where kernel updates cannot be immediately applied
• Unload unnecessary iSCSI transport modules if they are not required for system operation
• Implement mandatory access control policies (SELinux/AppArmor) to restrict sysfs access to authorized processes only

# Configuration example - Restrict access to iSCSI transport handle files
# Add audit rule to monitor access attempts
auditctl -w /sys/class/iscsi_transport/ -p r -k iscsi_handle_access

# If iSCSI is not needed, prevent module loading
echo "install iscsi_tcp /bin/false" >> /etc/modprobe.d/disable-iscsi.conf
echo "install libiscsi /bin/false" >> /etc/modprobe.d/disable-iscsi.conf