Loading vulnerability…
Linux LIO SCSI Target XCOPY Directory Traversal Arbitrary Backstore Access
CVE-2020-28374 is an improper-input-validation flaw in the Linux kernel LIO SCSI target implementation before 5.10.7, in drivers/target/target_core_xcopy.c. Insufficient validation of identifiers in XCOPY requests permits directory traversal and causes I/O to be proxied through an attacker-selected backstore. An authenticated attacker able to submit LIO block requests can read or write files and overwrite arbitrary blocks on an exported SCSI device backing store.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits unauthorized reads and writes through the exported SCSI target’s backing store. An attacker can overwrite arbitrary blocks, corrupting or altering stored data; the resulting condition may potentially support further attacks, including privilege escalation, depending on the backing store’s use.
If you can’t patch tonight, do this now.
Restrict access to LIO/iSCSI targets to trusted, authenticated initiators and isolate target traffic from untrusted networks. Disable or avoid exposing XCOPY-capable SCSI target functionality where it is not operationally required. Limit exported LUNs and backstores to data that is appropriate for connected initiators to access, and monitor for anomalous XCOPY or LIO block requests.
Patch, then assume compromise.
Upgrade to a Linux kernel version containing the fix, including Linux kernel 5.10.7 or later where applicable. For affected Red Hat Enterprise Linux deployments, install the applicable updated kernel or kpatch-patch package supplied through the relevant 2021 security errata. Reboot after installing a conventional kernel update so that the patched kernel is active; live-patch packages are loaded to modify the running kernel.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.