CVEvulnerability
CVE-2020-28374
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-01-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:N
- Weaknesses
- CWE-22
Description
In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore.
Affected configurations
• linux linux kernel (< 5.10.7)
• fedoraproject fedora 32
• fedoraproject fedora 33
• debian debian linux 9.0
• debian debian linux 10.0
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- http://packetstormsecurity.com/files/161229/Kernel-Live-Patch-Security-Notice-LSN-0074-1.html Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2021/01/13/2 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/01/13/5 Mailing List, Third Party Advisory
- https://bugzilla.suse.com/attachment.cgi?id=844938 Issue Tracking, Third Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1178372 Issue Tracking, Patch, Third Party Advisory
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.7 Release Notes, Vendor Advisory
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2896c93811e39d63a4d9b63ccf12a8fbc226e5e4 Patch, Vendor Advisory
- https://github.com/torvalds/linux/commit/2896c93811e39d63a4d9b63ccf12a8fbc226e5e4 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/02/msg00018.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZEUPID5DZYLZBIO4BEVLHFUDZZIFL57/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HK7SRTITN5ABAUOOIGFVR7XE5YKYYAVO/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTGQDYIEO2GOCOOKADBHEITF44GY55QF/ lists.fedoraproject.org
- https://security.netapp.com/advisory/ntap-20210219-0002/ Third Party Advisory
- https://www.debian.org/security/2021/dsa-4843 Third Party Advisory
- http://packetstormsecurity.com/files/161229/Kernel-Live-Patch-Security-Notice-LSN-0074-1.html Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2021/01/13/2 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/01/13/5 Mailing List, Third Party Advisory
- https://bugzilla.suse.com/attachment.cgi?id=844938 Issue Tracking, Third Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1178372 Issue Tracking, Patch, Third Party Advisory
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.7 Release Notes, Vendor Advisory
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2896c93811e39d63a4d9b63ccf12a8fbc226e5e4 Patch, Vendor Advisory
- https://github.com/torvalds/linux/commit/2896c93811e39d63a4d9b63ccf12a8fbc226e5e4 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/02/msg00018.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZEUPID5DZYLZBIO4BEVLHFUDZZIFL57/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HK7SRTITN5ABAUOOIGFVR7XE5YKYYAVO/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTGQDYIEO2GOCOOKADBHEITF44GY55QF/ lists.fedoraproject.org
- https://security.netapp.com/advisory/ntap-20210219-0002/ Third Party Advisory
- https://www.debian.org/security/2021/dsa-4843 Third Party Advisory