A high-severity Double Free vulnerability in open-iscsi enables unauthenticated attackers to trigger a denial-of-service state.

This vulnerability is a Double Free (CWE-415), which occurs when an application attempts to free memory that has already been deallocated. An unauthenticated attacker positioned as a man-in-the-middle can trigger this condition, resulting in a crash or service disruption.

Successful exploitation results in a denial-of-service, which can disrupt critical storage connectivity and lead to significant operational downtime. Given the CVSS score of 8.7, the impact on service availability is substantial, particularly for infrastructure relying on iSCSI for data access.

Immediate Action: Apply security updates provided by your Linux distribution vendor as soon as they become available.

Proactive Monitoring: Monitor service stability and system logs for unexpected crashes or errors related to iSCSI processes.

Compensating Controls: Implement network-level segmentation to restrict access to iSCSI management interfaces to trusted entities only, reducing the opportunity for man-in-the-middle attacks.

Public Exploit Available: No (exploit_available: false)

Organizations should monitor their respective distribution security bulletins for the release of a patch addressing this Double Free vulnerability. Until a patch is applied, ensure that iSCSI traffic is isolated within secure network segments to mitigate the risk of interception by unauthorized actors.