CVE-2020-28374

In drivers/target/targetcorexcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a...

CVE-2021-3139: Improper Limitation of a Pathname to a Restricted Directory

In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopylocateudev in tcmurcmdhandler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if th...

PT-2021-19281

Name of the Vulnerable Software and Affected Versions Open-iSCSI tcmu-runner versions 1.3.x through 1.5.2 Description The issue allows remote attackers to read or write files via directory traversal in an XCOPY request, due to a lack of check for transport-layer restrictions in the xcopy locate...

Open Iscsi Tcmu-runner Path Traversal Vulnerability

Open Iscsi Tcmu-runner is an Open Iscsi individual developer's daemon for handling the LIO TCM-User backstore userspace in Iscsi. A path traversal vulnerability exists in Open-iSCSI tcmu-runner, which stems from a lack of checking of transport layer restrictions by the program, allowing remote...

CVE-2020-28374

In drivers/target/targetcorexcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a...

UBUNTU-CVE-2020-28374

In drivers/target/targetcorexcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a...

Unbreakable Enterprise kernel-container security update

4.14.35-2025.404.1.1.el7 - target: fix XCOPY NAA identifier lookup David Disseldorp Orabug: 32248040 CVE-2020-28374 4.14.35-2025.404.1.el7 - xenbus/xenbusbackend: Disallow pending watch messages SeongJae Park Orabug: 32253412 CVE-2020-29568 - xen/xenbus: Count pending messages for each watch...

Unbreakable Enterprise kernel security update

4.1.12-124.46.4.1 - target: fix XCOPY NAA identifier lookup Mike Christie Orabug: 32248041 CVE-2020-28374 4.1.12-124.46.4 - xen/events: block rogue events for some time Juergen Gross Orabug: 31984335 CVE-2020-27673 - xen/events: defer eoi in case of excessive number of events Juergen Gross Orabug...

Unbreakable Enterprise kernel security update

4.14.35-2025.404.1.1 - target: fix XCOPY NAA identifier lookup David Disseldorp Orabug: 32248040 CVE-2020-28374 4.14.35-2025.404.1 - xenbus/xenbusbackend: Disallow pending watch messages SeongJae Park Orabug: 32253412 CVE-2020-29568 - xen/xenbus: Count pending messages for each watch SeongJae Par...

Linux kernel 路径遍历漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel versions prior to 5.10.7, which stems from insufficient identifier checking in drivers/target/targetcorexcopy.c, and can be...

PT-2021-2997

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.10.7 Description The issue is related to insufficient identifier checking in the LIO SCSI target code, which can be exploited by remote attackers to read or write files via directory traversal in an XCOPY...

Product update: Virtuozzo Infrastructure Platform 2.5 Update 5 (2.5.0-1639)

This update provides a new feature as well as stability and usability fixes. Vulnerability id: VSTOR-20558 The same data path ID was assigned to VLAN interfaces in OVS bridges. Vulnerability id: VSTOR-20913 Unable to update storage license. Vulnerability id: VSTOR-21089 Under certain circumstance...