#VU97632 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Linux target framework (tgt) - CVE-2024-45751

Vulnerability identifier: #VU97632

Vulnerability risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-45751

CWE-ID: CWE-338

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
Linux target framework (tgt)
Universal components / Libraries / Libraries used by multiple products

Vendor: FUJITA Tomonori

Description

The vulnerability allows a remote attacker to bypass CHAP authentication.

The vulnerability exists due to the application attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.This results in predictable challenges which an attacker capable of recording network traffic between iSCSI target and initiator can abuse to bypass CHAP authentication by replaying previous responses.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Linux target framework (tgt): 0.9.0 - 1.0.92

---

External links
https://github.com/fujita/tgt/pull/67
https://github.com/fujita/tgt/compare/v1.0.92...v1.0.93
https://www.openwall.com/lists/oss-security/2024/09/07/2

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.