Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Linux target framework (tgt) - CVE-2024-45751

Vulnerability identifier: #VU97632

CSH Severity: Medium

CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-45751

CWE-ID: CWE-338

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass CHAP authentication.

The vulnerability exists due to the application attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.This results in predictable challenges which an attacker capable of recording network traffic between iSCSI target and initiator can abuse to bypass CHAP authentication by replaying previous responses.

Linux target framework (tgt)
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Ubuntu
Basesystem Module
openSUSE Leap
openEuler
tgt (Ubuntu package)
scsi-target-utils
scsi-target-utils-help
scsi-target-utils-rbd
scsi-target-utils-gluster
scsi-target-utils-debugsource
scsi-target-utils-debuginfo
tgt-debuginfo
tgt-debugsource
tgt

Install updates from vendor's website.

Linux target framework (tgt) - update to 1.0.93
tgt (Ubuntu package) - addressed in versions 1:1.0.43-0ubuntu4.1~14.04.3+esm1, 1:1.0.63-1ubuntu1.1+esm1, 1:1.0.72-1ubuntu1+esm1, 1:1.0.79-2ubuntu1.1, 1:1.0.80-1ubuntu2+esm1, 1:1.0.85-1.1ubuntu6+esm1
scsi-target-utils - update to 1.0.79-5
scsi-target-utils-help - update to 1.0.79-5
scsi-target-utils-rbd - update to 1.0.79-5
scsi-target-utils-gluster - update to 1.0.79-5
scsi-target-utils-debugsource - update to 1.0.79-5
scsi-target-utils-debuginfo - update to 1.0.79-5
tgt-debuginfo - addressed in versions 1.0.85-150400.3.6.1, 1.0.85-150600.10.3.1
tgt-debugsource - addressed in versions 1.0.85-150400.3.6.1, 1.0.85-150600.10.3.1
tgt - addressed in versions 1.0.85-150400.3.6.1, 1.0.85-150600.10.3.1

• https://github.com/fujita/tgt/pull/67
• https://github.com/fujita/tgt/compare/v1.0.92...v1.0.93
• https://www.openwall.com/lists/oss-security/2024/09/07/2

• CHAP authentication bypass in Linux target framework (tgt)
• Ubuntu update for tgt
• openEuler update for scsi-target-utils
• SUSE update for tgt
• SUSE update for tgt
• Ubuntu update for tgt