Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerability (USN-4713-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4713-1 advisory. It was discovered that the LIO SCSI target implementation in the Linux kernel performed insufficient identifier checking in certain XCOPY requests. An...

Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4711-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4711-1 advisory. It was discovered that the LIO SCSI target implementation in the Linux kernel performed insufficient identifier checking in certain XCOPY...

LSN-0074-1: Kernel Live Patch Security Notice

Elena Petrova discovered that the pin controller device tree implementation in the Linux kernel did not properly handle string references. A local attacker could use this to expose sensitive information kernel memory. CVE-2020-0427 Andy Nguyen discovered that the Bluetooth A2MP implementation in...

openSUSE Security Update : tcmu-runner (openSUSE-2021-97)

This update for tcmu-runner fixes the following issues : - CVE-2021-3139: Fixed a LIO security issue bsc1180676. This update was imported from the SUSE:SLE-15-SP2:Update update project. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Updated kernel packages fix security vulnerability

This kernel update is based on upstream 5.10.8 and fixes at least the following security issue: SCSI “EXTENDED COPY” XCOPY requests sent to a Linux SCSI target LIO allow an attacker to read or write anywhere on any LIO backstore configured on the host, provided the attacker has access to one LUN...

OPENSUSE-SU-2021:0128-1 Security update for tcmu-runner

This update for tcmu-runner fixes the following issue: - CVE-2021-3139: Fixed a LIO security issue bsc1180676. This update was imported from the SUSE:SLE-15:Update update project...

In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7 insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request aka CID-2896c93811e3. For example an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore.

...

[ASA-202101-32] linux-hardened: directory traversal

Arch Linux Security Advisory ASA-202101-32 ========================================== Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2020-28374 Package : linux-hardened Type : directory traversal Remote : No Link : https://security.archlinux.org/AVG-1443 Summary ======= The package linux-hardene...

SUSE SLES15 Security Update : tcmu-runner (SUSE-SU-2021:0158-1)

This update for tcmu-runner fixes the following issue : CVE-2021-3139: Fixed a LIO security issue bsc1180676. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as mu...

SUSE-SU-2021:0158-1 Security update for tcmu-runner

This update for tcmu-runner fixes the following issue: - CVE-2021-3139: Fixed a LIO security issue bsc1180676...

OPENSUSE-SU-2021:0097-1 Security update for tcmu-runner

This update for tcmu-runner fixes the following issues: - CVE-2021-3139: Fixed a LIO security issue bsc1180676. This update was imported from the SUSE:SLE-15-SP2:Update update project...

Security update for tcmu-runner (important)

openSUSE Security Update: Security update for tcmu-runner Announcement ID: openSUSE-SU-2021:0097-1 Rating: important References: 1180676 Cross-References: CVE-2021-3139 Affected Products: openSUSE Leap 15.2 An update that fixes one vulnerability is now available. Description: This update for...

SUSE-SU-2021:0143-1 Security update for tcmu-runner

This update for tcmu-runner fixes the following issue: - CVE-2021-3139: Fixed a LIO security issue bsc1180676...

SUSE-SU-2021:0133-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-28374: Fixed a LIO security issue bsc1178372. - CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver bsc1180559. -...

Ubuntu: Security Advisory (USN-4694-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4694-1 linux, linux-hwe, linux-hwe-5.4, linux-hwe-5.8, linux-lts-xenial vulnerability

It was discovered that the LIO SCSI target implementation in the Linux kernel performed insufficient identifier checking in certain XCOPY requests. An attacker with access to at least one LUN in a multiple backstore environment could use this to expose sensitive information or modify data...

USN-4694-1: Linux kernel vulnerability

It was discovered that the LIO SCSI target implementation in the Linux kernel performed insufficient identifier checking in certain XCOPY requests. An attacker with access to at least one LUN in a multiple backstore environment could use this to expose sensitive information or modify data...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Linux kernel vulnerability (USN-4694-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4694-1 advisory. It was discovered that the LIO SCSI target implementation in the Linux kernel performed insufficient identifier checking in certain XCOPY...

SUSE-SU-2021:0093-1 Security update for tcmu-runner

This update for tcmu-runner fixes the following issues: - CVE-2021-3139: Fixed a LIO security issue bsc1180676...

CVE-2020-28374

In drivers/target/targetcorexcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a...