CHAP authentication bypass in Linux target framework (tgt)

1) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

EUVDB-ID: #VU97632

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-45751

CWE-ID: CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass CHAP authentication.

The vulnerability exists due to the application attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.This results in predictable challenges which an attacker capable of recording network traffic between iSCSI target and initiator can abuse to bypass CHAP authentication by replaying previous responses.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Linux target framework (tgt): 0.9.0 - 1.0.92

CPE2.3

• cpe:2.3:a:fujita:tgt:0.9.0:*:*:*:*:*:*:*
• cpe:2.3:a:fujita:tgt:0.9.1:*:*:*:*:*:*:*
• cpe:2.3:a:fujita:tgt:0.9.2:*:*:*:*:*:*:*

External links

https://github.com/fujita/tgt/pull/67
https://github.com/fujita/tgt/compare/v1.0.92...v1.0.93
https://www.openwall.com/lists/oss-security/2024/09/07/2

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.