Summary
It was discovered that the LIO SCSI target implementation in the Linux
kernel performed insufficient identifier checking in certain XCOPY
requests. An attacker with access to at least one LUN in a multiple
backstore environment could use this to expose sensitive information or
modify data.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | linux | 4.4.0-200.232 |
| Ubuntu · 16.04 LTS 16.04:LTS | linux-hwe | 4.15.0-132.136~16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux | 4.15.0-132.136 |
| Ubuntu · 18.04 LTS 18.04:LTS | linux-hwe-5.4 | 5.4.0-62.70~18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux | 5.4.0-62.70 |
| Ubuntu · 20.04 LTS 20.04:LTS | linux-hwe-5.8 | 5.8.0-38.43~20.04.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | linux-lts-xenial | 4.4.0-200.232~14.04.1 |
Vulnerabilities 1
-
Unscored —
In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SC…
References
-
report
https://ubuntu.com/security/CVE-2020-28374