Re: heap buffer overflow in iSCSI CHAP base64 response parsing (iscsi_target_auth.c)

On Sun, May 17, 2026 at 10:54:58AM -0700, Alexandru Hossu wrote:
> Hi,
> 
> Was going through the iSCSI target code looking at what an
> unauthenticated initiator can reach before auth completes. The 2022
> commit that added base64 support to CHAP (1e5733883421, "scsi: target:
> iscsi: Support base64 in CHAP") stood out -- it extends the login path
> with a new decoding branch, so I read through chap_server_compute_hash()
> to see how the new case was handled compared to the existing HEX branch.

As this is public, no need to get [email protected] involved.

Please just send a patch to fix this.

thanks,

greg k-h