CVE-2020-28374: Linux Kernel Path Traversal Vulnerability

CVE-2020-28374 Overview

CVE-2020-28374 is a directory traversal vulnerability in the Linux kernel's LIO SCSI target code located in drivers/target/target_core_xcopy.c. The flaw stems from insufficient identifier checking in the XCOPY request handling, which allows remote attackers with access to an iSCSI LUN to read or write arbitrary files on the target system. This vulnerability affects Linux kernel versions prior to 5.10.7 and enables attackers to gain control over file access by proxying I/O operations through an attacker-selected backstore.

Critical Impact

Remote attackers with access to a single iSCSI LUN can exploit insufficient NAA identifier validation to perform unauthorized file read/write operations via directory traversal, potentially compromising data confidentiality and integrity across the storage infrastructure.

Affected Products

• Linux Kernel (versions prior to 5.10.7)
• Fedora 32 and 33
• Debian Linux 9.0 and 10.0

Discovery Timeline

• January 13, 2021 - CVE-2020-28374 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-28374

Vulnerability Analysis

The vulnerability exists in the XCOPY (Extended Copy) command implementation within the Linux kernel's LIO SCSI target subsystem. The XCOPY command is designed to allow efficient data movement between SCSI devices, but the affected implementation fails to properly validate NAA (Network Address Authority) device identifiers during lookup operations.

When processing XCOPY requests, the kernel code does not adequately verify that the source and destination device identifiers belong to devices the requesting initiator is authorized to access. This insufficient identifier checking creates a path traversal opportunity where an attacker can craft malicious XCOPY requests to access arbitrary backstores on the target system.

The attack can be executed remotely over a network if the attacker has access to even a single iSCSI LUN. By manipulating the device identifiers in the XCOPY request, an attacker can redirect I/O operations to arbitrary files on the target system, effectively bypassing storage access controls.

Root Cause

The root cause is improper validation of NAA device identifiers in the target_xcopy_locate_se_dev_e4_iter function. The original implementation used a search structure that did not properly restrict device lookups to authorized targets, allowing attackers to specify arbitrary device identifiers that would match unintended backstores. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal).

Attack Vector

The attack exploits the network-accessible iSCSI interface. An attacker requires low privileges (authenticated access to at least one iSCSI LUN) to exploit this vulnerability. The attack flow involves:

1. Establishing an authenticated iSCSI session with access to at least one LUN
2. Crafting a malicious XCOPY request with manipulated NAA device identifiers
3. Specifying attacker-controlled source or destination backstores in the request
4. The kernel incorrectly validates the identifiers and performs I/O operations on unauthorized files

The following patch shows the security fix implemented in commit 2896c93811e39d63a4d9b63ccf12a8fbc226e5e4:

 	return 0;
 }
 
-struct xcopy_dev_search_info {
-	const unsigned char *dev_wwn;
-	struct se_device *found_dev;
-};
-
+/**
+ * target_xcopy_locate_se_dev_e4_iter - compare XCOPY NAA device identifiers
+ *
+ * @se_dev: device being considered for match
+ * @dev_wwn: XCOPY requested NAA dev_wwn
+ * @return: 1 on match, 0 on no-match
+ */
 static int target_xcopy_locate_se_dev_e4_iter(struct se_device *se_dev,
-					      void *data)
+					      const unsigned char *dev_wwn)
 {
-	struct xcopy_dev_search_info *info = data;
 	unsigned char tmp_dev_wwn[XCOPY_NAA_IEEE_REGEX_LEN];
 	int rc;
 
-	if (!se_dev->dev_attrib.emulate_3pc)
+	if (!se_dev->dev_attrib.emulate_3pc) {
+		pr_debug("XCOPY: emulate_3pc disabled on se_dev %p\n", se_dev);
 		return 0;
+	}
 
 	memset(&tmp_dev_wwn[0], 0, XCOPY_NAA_IEEE_REGEX_LEN);

Source: GitHub Linux Commit Reference

The fix modifies the identifier lookup function to properly validate NAA identifiers and adds reference tracking for remote LUN access:

 	struct se_device *dst_dev;
 	unsigned char dst_tid_wwn[XCOPY_NAA_IEEE_REGEX_LEN];
 	unsigned char local_dev_wwn[XCOPY_NAA_IEEE_REGEX_LEN];
+	struct percpu_ref *remote_lun_ref;
 
 	sector_t src_lba;
 	sector_t dst_lba;

Source: GitHub Linux Commit Reference

Detection Methods for CVE-2020-28374

Indicators of Compromise

• Unusual XCOPY SCSI commands targeting unexpected device identifiers or backstores
• Unexpected file access patterns on systems running iSCSI target services
• Anomalous I/O operations directed at system files or sensitive data paths
• iSCSI session logs showing access to LUNs not assigned to the initiator

Detection Strategies

• Monitor iSCSI target logs for XCOPY requests with suspicious or mismatched NAA identifiers
• Implement kernel auditing to track target_core_xcopy.c operations and file access patterns
• Deploy file integrity monitoring on systems running LIO SCSI target services
• Use SentinelOne Singularity Platform to detect anomalous kernel-level file access operations

Monitoring Recommendations

• Enable detailed logging for the LIO SCSI target subsystem to capture XCOPY command details
• Configure alerts for any XCOPY operations that reference devices outside expected LUN assignments
• Implement network monitoring for unusual iSCSI traffic patterns or command sequences
• Review authentication logs for iSCSI sessions and correlate with XCOPY activity

How to Mitigate CVE-2020-28374

Immediate Actions Required

• Update the Linux kernel to version 5.10.7 or later which contains the security fix
• Apply vendor-specific kernel patches for Debian, Fedora, or your Linux distribution
• Restrict network access to iSCSI target services to trusted initiators only
• Review and audit current iSCSI LUN assignments and access permissions

Patch Information

The vulnerability was fixed in Linux kernel version 5.10.7. The security patch commit 2896c93811e39d63a4d9b63ccf12a8fbc226e5e4 addresses the insufficient NAA identifier validation in the XCOPY implementation. Distribution-specific patches are available through:

• Debian Security Advisory DSA-4843
• Fedora Package Security Updates
• Linux Kernel ChangeLog
• Kernel Live Patch via Packet Storm

Workarounds

• Disable XCOPY (Extended Copy) functionality by setting emulate_3pc=0 on all backstore devices if not required
• Implement strict network segmentation to isolate iSCSI target services from untrusted networks
• Use firewall rules to limit iSCSI initiator connections to known, authorized hosts only
• Consider disabling iSCSI target services temporarily until patching is complete in high-risk environments

# Disable XCOPY/3PC emulation on a targetcli backstore
# This prevents XCOPY operations but may impact legitimate data movement operations
targetcli /backstores/fileio/disk1 set attribute emulate_3pc=0

# Restrict iSCSI access via iptables (example: allow only trusted initiator IP)
iptables -A INPUT -p tcp --dport 3260 -s <trusted_initiator_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 3260 -j DROP