CVE-2020-28374: Linux Kernel Path Traversal Vulnerability

CVE-2020-28374 Overview

CVE-2020-28374 is a directory traversal vulnerability in the Linux kernel's LIO SCSI target subsystem. The flaw exists in drivers/target/target_core_xcopy.c and affects Linux kernel versions before 5.10.7. Insufficient identifier checking in the XCOPY (Extended Copy) request handler allows remote attackers with access to a single iSCSI LUN to read or write files via path traversal. The attacker gains control over file access because I/O operations are proxied through an attacker-selected backstore. The vulnerability is tracked under [CWE-22] (Path Traversal) and was patched upstream in commit 2896c93811e3.

Critical Impact
An authenticated iSCSI initiator with access to one LUN can read or write data on any other backstore on the target, bypassing iSCSI ACLs and breaking tenant isolation.

Affected Products

Linux Kernel versions prior to 5.10.7
Fedora 32 and Fedora 33
Debian Linux 9.0 and 10.0

Discovery Timeline

2021-01-13 - CVE CVE-2020-28374 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-28374

Vulnerability Analysis

The Linux kernel's LIO (Linux-IO) target framework implements SCSI XCOPY (Extended Copy / Third-Party Copy), enabling a SCSI initiator to instruct a target to copy data between two devices without routing the payload through the initiator. To locate the source and destination devices for a copy operation, the kernel iterates through registered SCSI devices and matches them against the NAA (Network Address Authority) IEEE WWN identifier supplied in the XCOPY command descriptor block.

The pre-patch implementation did not properly validate that the requested NAA identifier corresponded to a backstore the initiator was authorized to access. An attacker with access to any single LUN on the target could craft an XCOPY request referencing the WWN of any other backstore configured on the system. The target kernel would then proxy reads or writes against that backstore on the attacker's behalf, bypassing iSCSI ACLs and LUN masking entirely.

Root Cause

The matching logic in target_xcopy_locate_se_dev_e4_iter() resolved NAA WWNs across the global pool of se_device structures without scoping the lookup to devices the requesting session was permitted to access. Once a match was found, I/O was issued directly against that device, regardless of whether the original iSCSI session ever had a LUN mapping to it.

Attack Vector

Exploitation requires network reachability to the iSCSI portal and credentials for at least one exported LUN. The attacker issues an XCOPY (EXTENDED COPY, opcode 0x83) command with a CSCD descriptor containing the NAA identifier of a target backstore. The kernel locates the matching se_device and performs the requested read or write operation, returning data or persisting attacker-controlled content. This enables cross-tenant disclosure, configuration tampering, and potential code execution on hosts that mount the affected backstores.

 	return 0;
 }
 
-struct xcopy_dev_search_info {
-	const unsigned char *dev_wwn;
-	struct se_device *found_dev;
-};
-
+/**
+ * target_xcopy_locate_se_dev_e4_iter - compare XCOPY NAA device identifiers
+ *
+ * @se_dev: device being considered for match
+ * @dev_wwn: XCOPY requested NAA dev_wwn
+ * @return: 1 on match, 0 on no-match
+ */
 static int target_xcopy_locate_se_dev_e4_iter(struct se_device *se_dev,
-					      void *data)
+					      const unsigned char *dev_wwn)
 {
-	struct xcopy_dev_search_info *info = data;
 	unsigned char tmp_dev_wwn[XCOPY_NAA_IEEE_REGEX_LEN];
 	int rc;
 
-	if (!se_dev->dev_attrib.emulate_3pc)
+	if (!se_dev->dev_attrib.emulate_3pc) {
+		pr_debug("XCOPY: emulate_3pc disabled on se_dev %p\n", se_dev);
 		return 0;
+	}
 
 	memset(&tmp_dev_wwn[0], 0, XCOPY_NAA_IEEE_REGEX_LEN);

Source: Linux Kernel Commit 2896c93811e3

Detection Methods for CVE-2020-28374

Indicators of Compromise

Unexpected EXTENDED COPY (SCSI opcode 0x83) commands arriving on iSCSI portals from initiators that do not normally issue XCOPY workloads.
Kernel log entries from the target_core_xcopy subsystem referencing NAA WWN lookups for devices not mapped to the requesting initiator's LUN view.
Unexplained read or write activity on backstores whose LUNs are not exported to the session that generated the I/O.

Detection Strategies

Inspect kernel versions on all hosts exporting iSCSI targets and flag any system running a kernel earlier than 5.10.7 without the backported 2896c93811e3 fix.
Capture and review iSCSI traffic for EXTENDED COPY CDBs and correlate the NAA identifiers in CSCD descriptors against the LUNs each initiator is authorized to access.
Audit targetcli configuration to enumerate backstores where emulate_3pc is enabled, since these are the devices reachable via the vulnerable path.

Monitoring Recommendations

Forward kernel ring buffer messages and SCSI target audit events to a centralized log store for retrospective hunting of anomalous XCOPY activity.
Alert on unexpected backstore I/O patterns, such as writes to LUNs that should be read-only for a given initiator or access outside normal change windows.
Track package versions of linux-image, kernel, and live-patch modules across the fleet to confirm remediation status.

How to Mitigate CVE-2020-28374

Immediate Actions Required

Upgrade the Linux kernel to version 5.10.7 or later, or apply the distribution backport containing commit 2896c93811e3.
Restrict iSCSI portal exposure to trusted management networks and enforce CHAP authentication on all targets.
Audit targetcli ACLs to ensure each initiator is granted access only to the LUNs it requires.

Patch Information

The upstream fix is included in the Linux 5.10.7 stable release. Vendor advisories and backports are available from Linux Kernel ChangeLog 5.10.7, Debian Security Advisory DSA-4843, the Debian LTS Announcement, Fedora Package Announcement, SUSE Bugzilla 1178372, and the NetApp Security Advisory NTAP-20210219-0002. Ubuntu users can apply the kernel live patch described in the Kernel Live Patch Security Notice LSN-0074-1.

Workarounds

Disable XCOPY emulation on each backstore by setting emulate_3pc=0 in targetcli until the kernel patch can be deployed.
Segment iSCSI tenants onto separate target hosts so a compromised initiator cannot reference NAA identifiers belonging to other tenants.
Place iSCSI traffic behind a dedicated VLAN or IPsec tunnel and remove untrusted initiator access from production targets.

bash

# Disable third-party copy (XCOPY) emulation on a LIO backstore
targetcli /backstores/block/<backstore_name> set attribute emulate_3pc=0

# Verify kernel version contains the fix (5.10.7 or later, or distribution backport)
uname -r

# On Debian/Ubuntu, install the patched kernel
apt-get update && apt-get install --only-upgrade linux-image-generic