PT-2021-2997 · Linux+8 · Linux Kernel+8
David Disseldorp
·
Published
2021-01-11
·
Updated
2021-05-28
·
CVE-2020-28374
CVSS v2.0
8.5
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.10.7
Description
The issue is related to insufficient identifier checking in the LIO SCSI target code, which can be exploited by remote attackers to read or write files via directory traversal in an XCOPY request. This can occur over a network if the attacker has access to one iSCSI LUN, allowing them to gain control over file access because I/O operations are proxied via an attacker-selected backstore.
Recommendations
For Linux kernel versions prior to 5.10.7, update to version 5.10.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the
target core xcopy.c driver or disabling the XCOPY request functionality until a patch is available. Restrict access to iSCSI LUNs to minimize the risk of exploitation.Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Suse
Ubuntu