VulnSocial

CVE-2011-0001(zaal / tgt)

LOWCVSS 5.0 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Double free vulnerability in the iscsi_rx_handler function (usr/iscsi/iscsid.c) in the tgt daemon (tgtd) in Linux SCSI target framework (tgt) before 1.0.14, aka scsi-target-utils, allows remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via unknown vectors related to a buffer overflow during iscsi login. NOTE: some of these details are obtained from third party information.

zaal CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-399

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • tgt

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • 2 total mentions across 1 day

Affected systems

Vendors
zaal
Products
tgt

14 versions affected across 1 product

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-11-07: 211-07
Referenced assets1 URL
Full discourse2 posts
  • 🇰🇷Dave_Joe_9377🇦🇺@Dave_Joe_9377

    CVE-2011-0001 | Returning the same room key twice A double free is like checking out of the same room twice and confusing the booking system. In the Linux SCSI target daemon, flawed iSCSI login handling could corrupt memory and crash a network-facing storage service. The official record describes possible arbitrary code execution, not a guaranteed takeover. It affects tgt before 1.0.14 and notes that some details came from third parties. The lesson: memory ownership must be clear, and storage services need patches too.

    1000115
    3.2K followersView on X
  • 🇰🇷Dave_Joe_9377🇦🇺@Dave_Joe_9377

    The flaw involved iSCSI login handling in tgt before 1.0.14. The CVE notes that some details came from third-party information. Lesson: track memory ownership and patch network-facing storage services. Official record: https://github.com/CVEProject/cvelistV5/blob/main/cves/2011/0xxx/CVE-2011-0001.json

    000017
    3.2K followersView on X
CPE platform detail15 entries

15 of 15 entries

PartVendorProductVersionTarget SWTarget HW
Appzaaltgt---
Appzaaltgt0.9.5--
Appzaaltgt1.0.0--
Appzaaltgt1.0.1--
Appzaaltgt1.0.10--
Appzaaltgt1.0.11--
Appzaaltgt1.0.12--
Appzaaltgt1.0.2--
Appzaaltgt1.0.3--
Appzaaltgt1.0.4--
Appzaaltgt1.0.5--
Appzaaltgt1.0.6--
Appzaaltgt1.0.7--
Appzaaltgt1.0.8--
Appzaaltgt1.0.9--

Explore more

Back to dashboardzaal CVEstgt vulnerabilities