A sensitive information disclosure vulnerability in the Linux kernel libiscsi implementation poses a risk to data confidentiality.

The iscsi_scsi_cmd_rsp function incorrectly handles the copying of sense data from the target-supplied data segment, leading to the leakage of stale memory contents. This is an unauthenticated vulnerability affecting iSCSI communication.

Information disclosure of stale memory contents could expose sensitive data, such as credentials, encryption keys, or proprietary information, residing in kernel space. While the CVSS score is 7.5, the impact is primarily focused on confidentiality, potentially leading to unauthorized access to sensitive systems.

Immediate Action: Update the Linux kernel to version 6.6.151, 6.12.103, 6.18.44, or 7.1.8 to patch the memory handling error.

Proactive Monitoring: Review system logs for any anomalous behavior related to iSCSI storage connections and monitor for potential memory corruption indicators.

Compensating Controls: Isolate iSCSI storage traffic to dedicated, secure networks to minimize the attack surface and potential for interception.

Public Exploit Available: No

Confidentiality of storage traffic is paramount in enterprise environments. Organizations should prioritize updating their kernel to the fixed versions to prevent the exposure of sensitive kernel memory via the iSCSI protocol.