CVE-2020-28374: Path Traversal

Published Nov 20, 2020
·
Updated

A flaw was found in the Linux kernel’s implementation of the Linux SCSI target host, where an authenticated attacker could write to any block on the exported SCSI device backing store. This flaw allows an authenticated attacker to send LIO block requests to the Linux system to overwrite data on the backing store. The highest threat from this vulnerability is to integrity. In addition, this flaw affects the tcmu-runner package, where the affected SCSI command is called.

Other sources

A flaw was found in the Linux kernels implementation of Linux SCSI target host where an authenticated attacker to write to any block on the exported scsi device backing store. This could allow an authenticated attacker who is able to send LIO block requests to the linux system to overwrite data on the backing store.

The system using the backing store may have corrupted data, or incorrect data and depending on the use case, this could possibly be leveraged to a more serious attack such as privilege escalation.

— Red Hat

In drivers/target/targetcorexcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore.

Affected Software

100 affected componentsFixes available
redhat/kernel-rt<0:3.10.0-1160.21.1.rt56.1158.el7
0:3.10.0-1160.21.1.rt56.1158.el7
redhat/kernel<0:3.10.0-1160.21.1.el7
0:3.10.0-1160.21.1.el7
redhat/kernel<0:3.10.0-693.90.2.el7
0:3.10.0-693.90.2.el7
redhat/kernel<0:3.10.0-957.72.1.el7
0:3.10.0-957.72.1.el7
redhat/kernel<0:3.10.0-1062.49.1.el7
0:3.10.0-1062.49.1.el7
redhat/kernel-rt<0:4.18.0-240.22.1.rt7.77.el8_3
0:4.18.0-240.22.1.rt7.77.el8_3
redhat/kernel<0:4.18.0-240.22.1.el8_3
0:4.18.0-240.22.1.el8_3
redhat/kernel<0:4.18.0-147.48.1.el8_1
0:4.18.0-147.48.1.el8_1
redhat/kernel-rt<0:4.18.0-193.56.1.rt13.106.el8_2
0:4.18.0-193.56.1.rt13.106.el8_2
redhat/kernel<0:4.18.0-193.56.1.el8_2
0:4.18.0-193.56.1.el8_2
Linux Linux kernel<5.10.7
Fedoraproject Fedora=32
Fedoraproject Fedora=33
Debian Debian Linux=9.0
Debian Debian Linux=10.0
debian/linux
5.10.223-15.10.234-16.1.129-16.1.135-16.12.25-16.12.27-1
ubuntu/linux<3.13.0-184.235
3.13.0-184.235
ubuntu/linux-aws<4.4.0-1085.89
4.4.0-1085.89
ubuntu/linux-azure<4.15.0-1106.118~14.04.1
4.15.0-1106.118~14.04.1
ubuntu/linux-lts-xenial<4.4.0-200.232~14.04.1
4.4.0-200.232~14.04.1
ubuntu/linux<4.4.0-200.232
4.4.0-200.232
ubuntu/linux-aws<4.4.0-1121.135
4.4.0-1121.135
ubuntu/linux-aws-hwe<4.15.0-1093.99~16.04.1
4.15.0-1093.99~16.04.1
ubuntu/linux-azure<4.15.0-1106.118~16.04.1
4.15.0-1106.118~16.04.1
ubuntu/linux-gcp<4.15.0-1092.105~16.04.1
4.15.0-1092.105~16.04.1
ubuntu/linux-hwe<4.15.0-132.136~16.04.1
4.15.0-132.136~16.04.1
ubuntu/linux-kvm<4.4.0-1087.96
4.4.0-1087.96
ubuntu/linux-oracle<4.15.0-1064.71~16.04.1
4.15.0-1064.71~16.04.1
ubuntu/linux-raspi2<4.4.0-1145.155
4.4.0-1145.155
ubuntu/linux-snapdragon<4.4.0-1149.159
4.4.0-1149.159
ubuntu/linux-hwe-edge*
ubuntu/linux-fips<4.4.0-1054.60
4.4.0-1054.60
ubuntu/linux-fips*
ubuntu/linux<4.15.0-132.136
4.15.0-132.136
ubuntu/linux-aws<4.15.0-1093.99
4.15.0-1093.99
ubuntu/linux-aws-5.4<5.4.0-1037.39~18.04.1
5.4.0-1037.39~18.04.1
ubuntu/linux-azure-4.15<4.15.0-1106.118
4.15.0-1106.118
ubuntu/linux-azure-5.4<5.4.0-1039.41~18.04.1
5.4.0-1039.41~18.04.1
ubuntu/linux-dell300x<4.15.0-1011.15
4.15.0-1011.15
ubuntu/linux-gcp-4.15<4.15.0-1092.105
4.15.0-1092.105
ubuntu/linux-gcp-5.4<5.4.0-1036.39~18.04.1
5.4.0-1036.39~18.04.1
ubuntu/linux-gke-4.15<4.15.0-1078.83
4.15.0-1078.83
ubuntu/linux-gke-5.0<5.0.0-1051.53
5.0.0-1051.53
ubuntu/linux-gke-5.3<5.3.0-1040.43
5.3.0-1040.43
ubuntu/linux-gke-5.4<5.4.0-1035.37~18.04.1
5.4.0-1035.37~18.04.1
ubuntu/linux-gkeop-5.4<5.4.0-1009.10~18.04.1
5.4.0-1009.10~18.04.1
ubuntu/linux-hwe<5.3.0-70.66
5.3.0-70.66
ubuntu/linux-hwe-5.4<5.4.0-62.70~18.04.1
5.4.0-62.70~18.04.1
ubuntu/linux-kvm<4.15.0-1084.86
4.15.0-1084.86
ubuntu/linux-oracle<4.15.0-1064.71
4.15.0-1064.71
ubuntu/linux-oracle-5.4<5.4.0-1037.40~18.04.1
5.4.0-1037.40~18.04.1
ubuntu/linux-raspi-5.4<5.4.0-1028.31~18.04.1
5.4.0-1028.31~18.04.1
ubuntu/linux-raspi2<4.15.0-1078.83
4.15.0-1078.83
ubuntu/linux-raspi2-5.3<5.3.0-1037.39
5.3.0-1037.39
ubuntu/linux-snapdragon<4.15.0-1095.104
4.15.0-1095.104
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gcp-edge*
ubuntu/linux-hwe-edge*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-fips<4.15.0-2036.38
4.15.0-2036.38
ubuntu/linux-azure-fips<4.15.0-2018.21
4.15.0-2018.21
ubuntu/linux-fips<4.15.0-1051.59
4.15.0-1051.59
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.4.0-62.70
5.4.0-62.70
ubuntu/linux-aws<5.4.0-1037.39
5.4.0-1037.39
ubuntu/linux-azure<5.4.0-1039.41
5.4.0-1039.41
ubuntu/linux-gcp<5.4.0-1036.39
5.4.0-1036.39
ubuntu/linux-gkeop<5.4.0-1009.10
5.4.0-1009.10
ubuntu/linux-hwe-5.8<5.8.0-38.43~20.04.1
5.8.0-38.43~20.04.1
ubuntu/linux-kvm<5.4.0-1032.33
5.4.0-1032.33
ubuntu/linux-oem-5.10<5.10.0-1014.15
5.10.0-1014.15
ubuntu/linux-oem-5.6<5.6.0-1047.51
5.6.0-1047.51
ubuntu/linux-oracle<5.4.0-1037.40
5.4.0-1037.40
ubuntu/linux-raspi<5.4.0-1028.31
5.4.0-1028.31
ubuntu/linux-azure-fde*
ubuntu/linux-gke*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-aws-fips<5.4.0-1069.73+fips2
5.4.0-1069.73+fips2
ubuntu/linux-azure-fips<5.4.0-1073.76+fips1
5.4.0-1073.76+fips1
ubuntu/linux-gcp-fips<5.4.0-1067.71~20.04.1
5.4.0-1067.71~20.04.1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-raspi-realtime*
ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/kernel-rt to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-1160.21.1.rt56.1158.el7
  2. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-1160.21.1.el7
  3. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-693.90.2.el7
  4. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-957.72.1.el7
  5. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:3.10.0-1062.49.1.el7
  6. Upgrade

    Upgrade redhat/kernel-rt to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-240.22.1.rt7.77.el8_3
  7. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-240.22.1.el8_3
  8. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-147.48.1.el8_1
  9. Upgrade

    Upgrade redhat/kernel-rt to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-193.56.1.rt13.106.el8_2
  10. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 0:4.18.0-193.56.1.el8_2
  11. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
  12. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 3.13.0-184.235
  13. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1085.89
  14. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1106.118~14.04.1
  15. Upgrade

    Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.

    Fixed in 4.4.0-200.232~14.04.1
  16. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.4.0-200.232
  17. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1121.135
  18. Upgrade

    Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-1093.99~16.04.1
  19. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1106.118~16.04.1
  20. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 4.15.0-1092.105~16.04.1
  21. Upgrade

    Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-132.136~16.04.1
  22. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.4.0-1087.96
  23. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1064.71~16.04.1
  24. Upgrade

    Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.

    Fixed in 4.4.0-1145.155
  25. Upgrade

    Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.

    Fixed in 4.4.0-1149.159
  26. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.4.0-1054.60
  27. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.15.0-132.136
  28. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.15.0-1093.99
  29. Upgrade

    Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1037.39~18.04.1
  30. Upgrade

    Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1106.118
  31. Upgrade

    Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1039.41~18.04.1
  32. Upgrade

    Upgrade ubuntu/linux-dell300x to a version that resolves this vulnerability.

    Fixed in 4.15.0-1011.15
  33. Upgrade

    Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1092.105
  34. Upgrade

    Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1036.39~18.04.1
  35. Upgrade

    Upgrade ubuntu/linux-gke-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1078.83
  36. Upgrade

    Upgrade ubuntu/linux-gke-5.0 to a version that resolves this vulnerability.

    Fixed in 5.0.0-1051.53
  37. Upgrade

    Upgrade ubuntu/linux-gke-5.3 to a version that resolves this vulnerability.

    Fixed in 5.3.0-1040.43
  38. Upgrade

    Upgrade ubuntu/linux-gke-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1035.37~18.04.1
  39. Upgrade

    Upgrade ubuntu/linux-gkeop-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1009.10~18.04.1
  40. Upgrade

    Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.

    Fixed in 5.3.0-70.66
  41. Upgrade

    Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-62.70~18.04.1
  42. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.15.0-1084.86
  43. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1064.71
  44. Upgrade

    Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1037.40~18.04.1
  45. Upgrade

    Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1028.31~18.04.1
  46. Upgrade

    Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1078.83
  47. Upgrade

    Upgrade ubuntu/linux-raspi2-5.3 to a version that resolves this vulnerability.

    Fixed in 5.3.0-1037.39
  48. Upgrade

    Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.

    Fixed in 4.15.0-1095.104
  49. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2036.38
  50. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2018.21
  51. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-1051.59
  52. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.4.0-62.70
  53. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.4.0-1037.39
  54. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.4.0-1039.41
  55. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.4.0-1036.39
  56. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 5.4.0-1009.10
  57. Upgrade

    Upgrade ubuntu/linux-hwe-5.8 to a version that resolves this vulnerability.

    Fixed in 5.8.0-38.43~20.04.1
  58. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1032.33
  59. Upgrade

    Upgrade ubuntu/linux-oem-5.10 to a version that resolves this vulnerability.

    Fixed in 5.10.0-1014.15
  60. Upgrade

    Upgrade ubuntu/linux-oem-5.6 to a version that resolves this vulnerability.

    Fixed in 5.6.0-1047.51
  61. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.4.0-1037.40
  62. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.4.0-1028.31
  63. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1069.73+fips2
  64. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1073.76+fips1
  65. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1067.71~20.04.1
  66. Upgrade

    Upgrade Linux kernel to a version that resolves this vulnerability.

    Fixed in 5.10.7
  67. Configuration

    Disable XCOPY support for each backstore by setting /sys/kernel/config/target/core/<backstore>/<name>/attrib/emulate_3pc to 0, or run targetcli /backstores/<backstore>/<name> set attribute emulate_3pc=0. This workaround does not affect XCOPY requests sent to tcmu-runner.

    Linux SCSI target (LIO) backstores emulate_3pc = 0

Event History

Nov 20, 2020
Data Sourced
via Red Hat·04:25 AM
DescriptionSeverityAffected Software
Jan 12, 2021
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Jan 13, 2021
CVE Published
via MITRE·03:07 AM
Data Sourced
via MITRE·03:07 AM
Description

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2020-28374?

CVE-2020-28374 has been rated as a high severity vulnerability.

2

How do I fix CVE-2020-28374?

To fix CVE-2020-28374, update the Linux kernel to the latest version, specifically to the remedied versions provided by your distribution.

3

Who is affected by CVE-2020-28374?

CVE-2020-28374 affects systems running specific versions of the Linux kernel and those using SCSI target host implementations.

4

Can CVE-2020-28374 be exploited remotely?

CVE-2020-28374 requires authentication, so an attacker must have credentials to exploit this vulnerability.

5

What versions of Linux are impacted by CVE-2020-28374?

CVE-2020-28374 impacts Linux kernel versions prior to the patched releases including kernel-rt and various versions of Red Hat and Debian distributions.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203