CVE-2021-28361 Null dereference in n/a

High 7.5 Published 13 Mar 2021 Updated 3 Aug 2024

A remote attacker can crash the SPDK iSCSI target by sending a zero-length PDU, causing a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-28361?

CVE-2021-28361 is a high-severity vulnerability in n/a, published on 13 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with a zero length (but data is expected), the iSCSI target can crash with a NULL pointer dereference.

Weakness: CWE-476

Which versions are affected by CVE-2021-28361?

It affects 1 product.

Products include Spdk Storage Performance Development Kit.

How do I fix CVE-2021-28361?

Upgrade to a fixed version.

Is CVE-2021-28361 being exploited?

There is no known exploitation of CVE-2021-28361 in the wild and no public exploit code.

Sources

Also known as AZL-38836, AZL-39466, GHSA-f2h7-8qhx-58qw.