SPDK iSCSI target (before 20.01.01) and SPDK vhost target (before 19.01): A zero-length PDU sent where data is expected

Impact

A zero-length PDU sent where data is expected crashes the SPDK iSCSI target on a NULL pointer dereference. The companion vhost defect lets a guest VM build a circular descriptor chain that partially wedges the SPDK vhost target. Both are single-packet or single-guest denial of service against a userspace process that is serving block storage to many tenants at once - the iSCSI one needs no authentication and no valid target, and the vhost one is reachable from inside any guest whose virtio-blk/virtio-scsi device SPDK is backing. On a node running SPDK as the storage datapath for a rack of VMs, one guest kills storage for all of them.

Who can reach it

iSCSI variant: any host that can connect to the SPDK iSCSI target port (3260) on the storage network, unauthenticated. vhost variant: a malicious or compromised guest VM whose virtio block device is served by SPDK vhost - i.e. a paying tenant.

What to do

Upgrade SPDK past 20.01.01 (iSCSI) and 19.01 (vhost) and restart the target process, which disconnects all sessions on that node. Anyone still on an SPDK that old is likely running a vendored fork inside a storage appliance image, so the practical action is to identify the SPDK version compiled into your storage service, not to check a package manifest. For the vhost issue there is no configuration mitigation - the attacker is inside the guest by definition, which is the whole point of the exposure.

References