CVE-2021-3139: Tcmu-runner Path Traversal Vulnerability

CVE-2021-3139 Overview

CVE-2021-3139 is a directory traversal vulnerability in Open-iSCSI tcmu-runner versions 1.3.x, 1.4.x, and 1.5.x through 1.5.2. The vulnerability exists in the xcopy_locate_udev function within tcmur_cmd_handler.c, which lacks a check for transport-layer restrictions. This flaw allows remote attackers to read or write arbitrary files on the target system via directory traversal sequences in an XCOPY request. Notably, this vulnerability shares similarities with CVE-2020-28374, representing a comparable oversight in a different algorithm within the iSCSI ecosystem.

Critical Impact

Attackers with access to a single iSCSI LUN can exploit this vulnerability over the network to read sensitive data or write malicious files to arbitrary locations on the storage system, potentially leading to data exfiltration, system compromise, or service disruption.

Affected Products

• tcmu-runner versions 1.3.x
• tcmu-runner versions 1.4.x
• tcmu-runner versions 1.5.x through 1.5.2

Discovery Timeline

• January 13, 2021 - CVE-2021-3139 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-3139

Vulnerability Analysis

This directory traversal vulnerability stems from insufficient validation in the XCOPY command handling within tcmu-runner. The xcopy_locate_udev function in tcmur_cmd_handler.c fails to properly validate transport-layer restrictions when processing XCOPY requests. XCOPY (Extended Copy) is a SCSI command used for offloaded data transfer operations between storage devices.

When an attacker with access to at least one iSCSI Logical Unit Number (LUN) crafts a malicious XCOPY request containing directory traversal sequences (such as ../), the vulnerable function processes these sequences without sanitization. This allows the attacker to escape the intended storage boundary and access files outside the designated LUN's scope.

The vulnerability enables both read and write operations to arbitrary file system locations accessible by the tcmu-runner process. The impact is significant as iSCSI storage systems often contain sensitive enterprise data, and unauthorized file access could lead to data theft, corruption, or the injection of malicious content.

Root Cause

The root cause of CVE-2021-3139 is the absence of proper input validation and path canonicalization in the xcopy_locate_udev function. The function fails to implement checks that would prevent path traversal sequences from being processed, allowing attackers to specify file paths that extend beyond the intended storage boundaries. This is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) vulnerability where user-controlled input containing special path elements is not properly neutralized before being used to construct file system paths.

Attack Vector

The attack can be executed remotely over a network by any attacker who has access to at least one iSCSI LUN on the target system. The attack leverages the XCOPY SCSI command, which is designed for efficient data copying between storage devices. By embedding directory traversal sequences within the XCOPY request parameters, an attacker can redirect read or write operations to arbitrary files on the underlying file system.

The attack requires network access and low privileges (authenticated access to an iSCSI LUN), but no user interaction is needed. The attacker crafts a specially formatted XCOPY request containing path traversal sequences that, when processed by the vulnerable xcopy_locate_udev function, allow access to files outside the intended storage boundaries.

Detection Methods for CVE-2021-3139

Indicators of Compromise

• Unusual XCOPY requests in iSCSI logs containing path traversal sequences (../ or ..\)
• Unexpected file access or modification patterns on systems running tcmu-runner
• Anomalous read/write operations targeting files outside configured LUN boundaries
• Authentication events from iSCSI sessions followed by suspicious file system activity

Detection Strategies

• Monitor tcmu-runner logs for XCOPY commands with suspicious path patterns
• Implement network-based detection rules for iSCSI traffic containing directory traversal sequences
• Deploy file integrity monitoring on systems running vulnerable tcmu-runner versions
• Correlate iSCSI session logs with file access events to identify unauthorized operations

Monitoring Recommendations

• Enable verbose logging for tcmu-runner to capture detailed XCOPY request information
• Configure alerts for file system access attempts outside expected LUN paths
• Implement network traffic analysis for iSCSI protocols to detect malformed requests
• Monitor for unexpected changes to sensitive system files on iSCSI storage servers

How to Mitigate CVE-2021-3139

Immediate Actions Required

• Upgrade tcmu-runner to a patched version that addresses this vulnerability
• Review and restrict iSCSI LUN access to only authorized users and systems
• Implement network segmentation to limit exposure of iSCSI services
• Audit existing iSCSI configurations for overly permissive access controls

Patch Information

The tcmu-runner project has addressed this vulnerability through a code fix. The patch can be found in the GitHub Pull Request #644 for the tcmu-runner repository. Additional technical details and discussion are available in the SUSE Bugzilla Report and the Openwall OSS Security advisory. Organizations should update to the latest tcmu-runner version that includes this fix.

Workarounds

• Restrict network access to iSCSI services using firewall rules to limit exposure
• Implement strict access control lists (ACLs) for iSCSI initiators to minimize attack surface
• Consider disabling XCOPY functionality if not required for operational purposes
• Deploy application-layer firewalls or proxies capable of inspecting and filtering iSCSI traffic

# Example: Restrict iSCSI access using iptables
# Allow only trusted initiators to access iSCSI target port
iptables -A INPUT -p tcp --dport 3260 -s <trusted_initiator_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 3260 -j DROP