CVE-2020-28374
Published: 12 January 2021
In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore.
From the Ubuntu Security Team
It was discovered that the LIO SCSI target implementation in the Linux kernel performed insufficient identifier checking in certain XCOPY requests. An attacker with access to at least one LUN in a multiple backstore environment could use this to expose sensitive information or modify data.
Notes
Author | Note |
---|---|
sbeattie | MITIGATION XCOPY support is enabled by default, but can be disabled via: echo 0 > /sys/kernel/config/target/core/<backstore>/<name>/attrib/emulate_3pc or targetcli /backstores/<backstore>/<name> set attribute emulate_3pc=0 . This workaround does *not* affect XCOPY requests sent to tcmu-runner based backstores. |
Mitigation
XCOPY support is enabled by default, but can be disabled via: echo 0 > /sys/kernel/config/target/core/<backstore>/<name>/attrib/emulate_3pc or targetcli /backstores/<backstore>/<name> set attribute emulate_3pc=0 . This workaround does *not* affect XCOPY requests sent to tcmu-runner based backstores.
Priority
Status
Package | Release | Status |
---|---|---|
linux Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-132.136)
|
focal |
Released
(5.4.0-62.70)
|
|
groovy |
Released
(5.8.0-38.43)
|
|
trusty |
Released
(3.13.0-184.235)
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Released
(4.4.0-200.232)
|
|
Patches: Introduced by cbf031f425fd0b30ff10ba83b612753189a6bbbf |
||
linux-aws Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1093.99)
|
focal |
Released
(5.4.0-1037.39)
|
|
groovy |
Released
(5.8.0-1020.22)
|
|
trusty |
Released
(4.4.0-1085.89)
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Released
(4.4.0-1121.135)
|
|
linux-aws-5.0 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-aws-5.3)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-aws-5.3 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-aws-5.4)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-aws-5.4 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.4.0-1037.39~18.04.1)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-aws-hwe Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Released
(4.15.0-1093.99~16.04.1)
|
|
linux-azure Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-azure-5.3)
|
focal |
Released
(5.4.0-1039.41)
|
|
groovy |
Released
(5.8.0-1019.21)
|
|
trusty |
Released
(4.15.0-1106.118~14.04.1)
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Released
(4.15.0-1106.118~16.04.1)
|
|
linux-azure-4.15 Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1106.118)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-azure-5.3 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-azure-5.4)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-azure-5.4 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.4.0-1039.41~18.04.1)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-azure-edge Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-azure-5.3)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-dell300x Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1011.15)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-gcp Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-gcp-5.3)
|
focal |
Released
(5.4.0-1036.39)
|
|
groovy |
Released
(5.8.0-1019.20)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Released
(4.15.0-1092.105~16.04.1)
|
|
linux-gcp-4.15 Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1092.105)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-gcp-5.3 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-gcp-5.4)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-gcp-5.4 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.4.0-1036.39~18.04.1)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-gcp-edge Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-gcp-5.3)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-gke-4.15 Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1078.83)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-gke-5.0 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.0.0-1051.53)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-gke-5.3 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1040.43)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-gke-5.4 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.4.0-1035.37~18.04.1)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-gkeop Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Released
(5.4.0-1009.10)
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-gkeop-5.4 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.4.0-1009.10~18.04.1)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-hwe Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-70.66)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Released
(4.15.0-132.136~16.04.1)
|
|
linux-hwe-5.4 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.4.0-62.70~18.04.1)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-hwe-5.8 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Released
(5.8.0-38.43~20.04.1)
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-hwe-edge Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-hwe-5.4)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Ignored
(superseded by linux-hwe)
|
|
linux-kvm Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1084.86)
|
focal |
Released
(5.4.0-1032.33)
|
|
groovy |
Released
(5.8.0-1016.18)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Released
(4.4.0-1087.96)
|
|
linux-lts-trusty Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-lts-xenial Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Released
(4.4.0-200.232~14.04.1)
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-oem Launchpad, Ubuntu, Debian |
bionic |
Ignored
(was needs-triage now end-of-life)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Ignored
(superseded by linux-hwe)
|
|
linux-oem-5.10 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Released
(5.10.0-1014.15)
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-oem-5.6 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Released
(5.6.0-1047.51)
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-oem-osp1 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(was needs-triage now end-of-life)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-oracle Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1064.71)
|
focal |
Released
(5.4.0-1037.40)
|
|
groovy |
Released
(5.8.0-1017.18)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Released
(4.15.0-1064.71~16.04.1)
|
|
linux-oracle-5.0 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-oracle-5.3)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-oracle-5.3 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(superseded by linux-oracle-5.4)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-oracle-5.4 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.4.0-1037.40~18.04.1)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-raspi Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Released
(5.4.0-1028.31)
|
|
groovy |
Released
(5.8.0-1013.16)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-raspi-5.4 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.4.0-1028.31~18.04.1)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-raspi2 Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1078.83)
|
focal |
Ignored
(replaced by linux-raspi)
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Released
(4.4.0-1145.155)
|
|
linux-raspi2-5.3 Launchpad, Ubuntu, Debian |
bionic |
Released
(5.3.0-1037.39)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-riscv Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Ignored
(was needs-triage now end-of-life)
|
|
groovy |
Released
(5.8.0-14.16)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Does not exist
|
|
linux-snapdragon Launchpad, Ubuntu, Debian |
bionic |
Released
(4.15.0-1095.104)
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(5.11~rc4)
|
|
xenial |
Released
(4.4.0-1149.159)
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 8.1 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | Low |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | High |
Availability impact | None |
Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28374
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2896c93811e39d63a4d9b63ccf12a8fbc226e5e4
- https://github.com/open-iscsi/tcmu-runner/pull/644
- https://ubuntu.com/security/notices/USN-4694-1
- https://ubuntu.com/security/notices/USN-4713-1
- https://ubuntu.com/security/notices/USN-4711-1
- https://ubuntu.com/security/notices/USN-4709-1
- https://ubuntu.com/security/notices/USN-4713-2
- https://ubuntu.com/security/notices/USN-4753-1
- https://ubuntu.com/security/notices/USN-4901-1
- NVD
- Launchpad
- Debian