Fix CVE-2024-45751

(cherry picked from commit c0df7840eca818ab0b38e21a8ac57a2d5d1a1488)

backport-CVE-2024-45751.patch

@@ -0,0 +1,64 @@
+From abd8e0d987ab56013d360077202bf2aca20a42dd Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Tue, 3 Sep 2024 16:14:58 +0200
+Subject: [PATCH] chap: Use proper entropy source
+
+The challenge sent to the initiator is based on a poor
+source of randomness, it uses rand() without seeding it by srand().
+So the glibc PRNG is always seeded with 1 and as a consequence the
+sequence of challenges is always the same.
+
+An attacker which is able to monitor network traffic can apply a replay
+attack to bypass the CHAP authentication.  All the attacker has to do
+is waiting for the server or the service to restart and replay with a
+previously record CHAP session which fits into the sequence.
+
+To overcome the issue, use getrandom() to query the kernel random
+number generator.
+Also always send a challenge of length CHAP_CHALLENGE_MAX, there is no
+benefit in sending a variable length challenge.
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+---
+ usr/iscsi/chap.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/usr/iscsi/chap.c b/usr/iscsi/chap.c
+index aa0fc671..b89ecabd 100644
+--- a/usr/iscsi/chap.c
++++ b/usr/iscsi/chap.c
+@@ -28,6 +28,7 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
++#include <sys/random.h>
+ 
+ #include "iscsid.h"
+ #include "tgtd.h"
+@@ -359,22 +360,19 @@ static int chap_initiator_auth_create_challenge(struct iscsi_connection *conn)
+ 	sprintf(text, "%u", (unsigned char)conn->auth.chap.id);
+ 	text_key_add(conn, "CHAP_I", text);
+ 
+-	/*
+-	 * FIXME: does a random challenge length provide any benefits security-
+-	 * wise, or should we rather always use the max. allowed length of
+-	 * 1024 for the (unencoded) challenge?
+-	 */
+-	conn->auth.chap.challenge_size = (rand() % (CHAP_CHALLENGE_MAX / 2)) + CHAP_CHALLENGE_MAX / 2;
++	conn->auth.chap.challenge_size = CHAP_CHALLENGE_MAX;
+ 
+ 	conn->auth.chap.challenge = malloc(conn->auth.chap.challenge_size);
+ 	if (!conn->auth.chap.challenge)
+ 		return CHAP_TARGET_ERROR;
+ 
++	if (getrandom(conn->auth.chap.challenge, conn->auth.chap.challenge_size, 0) != conn->auth.chap.challenge_size)
++		return CHAP_TARGET_ERROR;
++
+ 	p = text;
+ 	strcpy(p, "0x");
+ 	p += 2;
+ 	for (i = 0; i < conn->auth.chap.challenge_size; i++) {
+-		conn->auth.chap.challenge[i] = rand();
+ 		sprintf(p, "%.2hhx", conn->auth.chap.challenge[i]);
+ 		p += 2;
+ 	}

scsi-target-utils.spec

@@ -6,7 +6,7 @@
 Summary:        The SCSI target daemon and utility programs
 Name:           scsi-target-utils
 Version:        1.0.91
-Release:        1
+Release:        2
 License:        GPLv2
 URL:            http://stgt.sourceforge.net/
 Source0:        https://github.com/fujita/tgt/archive/v%{version}/tgt-v%{version}.tar.gz
@@ -18,6 +18,7 @@ Source5:        tgtd.conf
 Patch1:         0002-remove-check-for-xsltproc.patch
 Patch2:         0003-default-config.patch
 Patch3:         tgt-1.0.79-Adapt-to-glusterfs-api-7.6.3.patch
+Patch4:         backport-CVE-2024-45751.patch
 
 BuildRequires:  docbook-style-xsl gcc libaio-devel libxslt perl-generators pkgconfig systemd-devel systemd-units
 BuildRequires:  libgfapi0
@@ -124,6 +125,9 @@ echo "%{_sbindir}/tgtd" > %{buildroot}/etc/ld.so.conf.d/%{name}-%{_arch}.conf
 %{_mandir}/man8/*
 
 %changelog
+* Mon Sep 09 2024 yaoxin <yao_xin001@hoperun.com> - 1.0.91-2
+- Fix CVE-2024-45751
+
 * Mon Mar 04 2024 xu_ping <707078654@qq.com> - 1.0.91-1
 - Update to 1.0.91