A high-severity authorization flaw in open-iscsi allows unprivileged local users to gain unauthorized access to the iscsiuio control socket, risking system integrity.

This is an incorrect authorization vulnerability (CWE-863) that occurs because the iscsiuio control socket does not properly validate the permissions of the calling user. The vulnerability allows an unprivileged local user to perform actions that should be restricted.

The CVSS score of 8.5 emphasizes the risk to local system security. By interacting with the control socket, a malicious local user could potentially disrupt storage connectivity or perform unauthorized configuration changes, which could lead to system instability or data unavailability.

Immediate Action: Apply the vendor-provided security updates or pull the fix from the official repository commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

Proactive Monitoring: Monitor system authorization and audit logs for unauthorized attempts to access or manipulate the iscsiuio daemon or its associated control sockets.

Compensating Controls: Implement strict file system permissions on the control socket and limit the set of users who have shell access to the host system.

Public Exploit Available: Unknown.

System administrators should prioritize patching open-iscsi on all Linux hosts. Ensuring that users have the principle of least privilege applied to their accounts will serve as a strong defense against this local authorization flaw.