An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with a zero length (but data is expected), the iSCSI target can crash with a NULL pointer dereference.

According to the version of the spdk package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - An issue was discovered in Storage Performance     Development Kit (SPDK) before 20.01.01. If a PDU is     sent to the iSCSI target with a zero length (but data     is expected), the iSCSI target can crash with a NULL     pointer dereference.(CVE-2021-28361)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Detections

Analytics

CVE-2021-28361

high

Tenable Plugins

high