Description
In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tcmu | 1.5.2-6 | — |
| Debian 13 | tcmu | 1.5.2-6 | — |
| Debian 12 | tcmu | 1.5.2-6 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | tcmu | No fix yet | — |
| Ubuntu 26.04 LTS | tcmu | No fix yet | — |
| Ubuntu 25.10 | tcmu | No fix yet | — |
| Ubuntu 24.04 LTS | tcmu | No fix yet | — |
| Ubuntu 22.04 LTS | tcmu | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | tcmu | 1.5.2-5ubuntu0.20.04.1 | USN-4707-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ceph Storage 4 | ceph +32 | 2:14.2.11-147.el7cp | RHSA-2021:1452 |
| Red Hat Ceph Storage 4 | ceph-ansible | 4.0.49.2-1.el7cp | RHSA-2021:1452 |
| Red Hat Ceph Storage 4 | gperftools +1 | 2.6.3-3.el8cp | RHSA-2021:1452 |
| Red Hat Ceph Storage 4 | libtcmu +1 | 1.5.2-2.el7cp | RHSA-2021:1452 |
| Red Hat Ceph Storage 4 | python3-rbd +4 | 2:14.2.11-147.el8cp | RHSA-2021:1452 |
| Red Hat Ceph Storage 3 | ceph +24 | 2:12.2.12-139.el7cp | RHSA-2021:1518 |
| Red Hat Ceph Storage 3 | ceph-ansible | 3.2.56-1.el7cp | RHSA-2021:1518 |
| Red Hat Ceph Storage 3 | cephmetrics +1 | 2.0.10-1.el7cp | RHSA-2021:1518 |
| Red Hat Ceph Storage 3 | grafana | 5.2.4-3.el7cp | RHSA-2021:1518 |
| Red Hat Ceph Storage 3 | tcmu-runner | 1.4.0-3.el7cp | RHSA-2021:1518 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | tcmu-runner | 1.5.2-3.3.1 | SUSE-SU-2021:0093-1 |
| SLES 15 SP1 | tcmu-runner | 1.4.0-3.9.1 | SUSE-SU-2021:0158-1 |
| SLES 15 | tcmu-runner | 1.4.0-3.9.1 | SUSE-SU-2021:0158-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP1 | tcmu-runner | 1.4.0-3.9.1 | SUSE-SU-2021:0158-1 |
| SLES for SAP 15 | tcmu-runner | 1.4.0-3.9.1 | SUSE-SU-2021:0158-1 |
| SLE HPC 15 SP1 | tcmu-runner | 1.4.0-3.9.1 | SUSE-SU-2021:0158-1 |
| SLE HPC 15 | tcmu-runner | 1.4.0-3.9.1 | SUSE-SU-2021:0158-1 |
| SUSE Manager Server 4.0 | tcmu-runner | 1.4.0-3.9.1 | SUSE-SU-2021:0158-1 |
| SUSE Manager Retail Branch Server 4.0 | tcmu-runner | 1.4.0-3.9.1 | SUSE-SU-2021:0158-1 |
| SUSE Manager Proxy 4.0 | tcmu-runner | 1.4.0-3.9.1 | SUSE-SU-2021:0158-1 |
| SUSE Enterprise Storage 6 | tcmu-runner | 1.4.0-3.9.1 | SUSE-SU-2021:0158-1, SUSE-SU-2021:0143-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.2 | tcmu-runner | 1.5.2-lp152.2.3.1 | openSUSE-SU-2021:0097-1 |
| openSUSE Leap 15.1 | tcmu-runner | 1.4.0-lp151.3.9.1 | openSUSE-SU-2021:0128-1 |
Advisories 8
- RHSA-2021:1518 Red Hat Security Advisory: Red Hat Ceph Storage 3.3 Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2021:1452 Red Hat Security Advisory: Red Hat Ceph Storage security, bug fix, and enhancement Update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- USN-4707-1 tcmu vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- SUSE-SU-2021:0158-1 Security update for tcmu-runner SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0097-1 Security update for tcmu-runner SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0128-1 Security update for tcmu-runner SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0093-1 Security update for tcmu-runner SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0143-1 Security update for tcmu-runner SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://bugzilla.suse.com/show_bug.cgi?id=1178372
- https://bugzilla.suse.com/attachment.cgi?id=844938
- https://www.openwall.com/lists/oss-security/2021/01/12/12
- [oss-security] 20210113 Re: CVE-2020-28374: Linux SCSI target (LIO) unrestricted copy offload mailing-list
- https://github.com/open-iscsi/tcmu-runner/pull/644