Vulnerabilities > CVE-2021-28361 - NULL Pointer Dereference vulnerability in Spdk Storage Performance Development KIT

CVSS 5.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

PARTIAL

network

low complexity

spdk

CWE-476

NVD

Published: 2021-03-13

Updated: 2021-03-18

Summary

An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with a zero length (but data is expected), the iSCSI target can crash with a NULL pointer dereference.

Vulnerable Configurations

Part	Description	Count
Application	Spdk Spdk Storage Performance Development KIT 1.0.0 Spdk Storage Performance Development KIT 1.2.0 Spdk Storage Performance Development KIT 16.06 Spdk Storage Performance Development KIT 16.08 Spdk Storage Performance Development KIT 16.12 Spdk Storage Performance Development KIT 17.03 Spdk Storage Performance Development KIT 17.07 Spdk Storage Performance Development KIT 17.07.1 Spdk Storage Performance Development KIT 17.10 Spdk Storage Performance Development KIT 17.10.1 Spdk Storage Performance Development KIT 18.01 Spdk Storage Performance Development KIT 18.01.1 Spdk Storage Performance Development KIT 18.04 Spdk Storage Performance Development KIT 18.04.1 Spdk Storage Performance Development KIT 18.07 Spdk Storage Performance Development KIT 18.07.1 Spdk Storage Performance Development KIT 18.10 Spdk Storage Performance Development KIT 18.10.1 Spdk Storage Performance Development KIT 19.01 Spdk Storage Performance Development KIT 19.04 Spdk Storage Performance Development KIT 19.04.1 Spdk Storage Performance Development KIT 19.07	22

Common Weakness Enumeration (CWE)

CWE-476 - NULL Pointer Dereference

References

https://github.com/spdk/spdk/releases/tag/v21.01.1