In drivers/target/targetcorexcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore.
[
{
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/target/target_core_xcopy.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"109412354421596048548264525472586396298",
"318599108608810188834490165156812967625",
"285759591661218305912677924308169410510",
"168339120518878556793481257831258718551"
]
},
"id": "CVE-2020-28374-32ed3197",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@2896c93811e39d63a4d9b63ccf12a8fbc226e5e4",
"signature_type": "Line"
},
{
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/target/target_core_xcopy.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"26119436734198239710138556023824657489",
"42173176748655741186252389272273002915",
"240377613063600372798432598461132177239",
"247654411226060703329714102496211319255",
"268058417523851710132556230395694478521",
"336171948712106189300471615300870886229",
"111248517342847040800247894550890984151",
"222087028043710184130258487365228810408",
"101304821089532543704450372080424978352",
"42976685713776441650516709261651653064",
"134433367853180226854056366271666041881",
"222532162497819963336504770820443304071",
"166603563080117322139295133910295804810",
"108830866322859223482056041759539387311",
"208359070184382813033920576855919497963",
"189709051298123419435803243149601209837",
"148619646956733540643101730530581167855",
"207964910765772160146025710124401341401",
"308145456737685972973437437440911589886",
"94392468866669602368969992170559342043",
"18029176433996242489956404136008932133",
"43933163198172755906799961697991140406",
"20042187382425779155553600944024971344",
"52908433147765994906305221297598214168",
"35376986793332447406090413516356724337",
"75771914478379736565092597637269891183",
"239881425654758120005521992002579228319",
"32879714747526255748146255920780664181",
"225310516006472639653591119931567958929",
"70173288253863847616304658199286456967",
"238712501269108735675564313741606419865",
"204778517915132366477234999073313815438",
"264718323159233332218872384820209815188",
"199852845364578705217009778587216997625",
"336036790367774047189608476127677452556",
"108453999794554694477067547766078668399",
"25534251530015178141878529372127205974",
"8337078952027276427266366335164114812",
"233123887789862351566432266488101457648",
"175597519347002094726023453212604182038",
"228717435256498690304113647640358770412",
"89195001521397330393221419971450877208",
"160830840638572599472705824582185821256",
"320786632388922607553919029720925382140",
"164145113014475318868917663819331483665",
"97826660052583990461105765997450489901",
"248327603405752503022608729173623164656",
"284105857400857967394196815494416619555",
"31314763071458221912687252380091958966",
"113871353626069208302640412675351913122",
"301597935194719882445342830257410883382",
"218514277042173950078853368630609625152",
"139481884394903234886363446588461453643",
"161254931310412057108174789930240346571",
"1000499577515883575508104634586149777",
"326745440056190673943545039657155075955",
"45833797182538034776216381483146664714",
"1055938726446985912149356461803364981",
"179481712528578264992664312273284064377",
"83734625921003377316000733505473987726",
"108384081064948054530471951404078848924",
"86626858193635146527759060705492501558",
"312125793360156186382134004551482848060",
"96541238136789978863318204985662490891",
"173527887234314480803398780147966160810",
"147993809116207391054773389090763058043",
"168309229071969317371403150188070785822",
"28524346768690654822989584461178841799"
]
},
"id": "CVE-2020-28374-8604191c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@2896c93811e39d63a4d9b63ccf12a8fbc226e5e4",
"signature_type": "Line"
},
{
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/target/target_core_xcopy.c",
"function": "target_xcopy_locate_se_dev_e4_iter"
},
"digest": {
"length": 781.0,
"function_hash": "183673497717324711100095156863782085509"
},
"id": "CVE-2020-28374-93a9d3a1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@2896c93811e39d63a4d9b63ccf12a8fbc226e5e4",
"signature_type": "Function"
},
{
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/target/target_core_xcopy.c",
"function": "target_xcopy_parse_target_descriptors"
},
"digest": {
"length": 2033.0,
"function_hash": "127585066891089819970687178641198595419"
},
"id": "CVE-2020-28374-b6d91244",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@2896c93811e39d63a4d9b63ccf12a8fbc226e5e4",
"signature_type": "Function"
},
{
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/target/target_core_xcopy.c",
"function": "target_xcopy_locate_se_dev_e4"
},
"digest": {
"length": 380.0,
"function_hash": "173601482462600622766716792730807963461"
},
"id": "CVE-2020-28374-db96391a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@2896c93811e39d63a4d9b63ccf12a8fbc226e5e4",
"signature_type": "Function"
},
{
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/target/target_core_xcopy.c",
"function": "xcopy_pt_undepend_remotedev"
},
"digest": {
"length": 344.0,
"function_hash": "33825289406118069940659240581309142808"
},
"id": "CVE-2020-28374-fb23f141",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@2896c93811e39d63a4d9b63ccf12a8fbc226e5e4",
"signature_type": "Function"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-28374.json"