Log in Start free

Vulnerability · Published Jan 13, 2021 · Assigned by mitre

CVE-2021-3139

High 8.1

In plain English

A high-severity security flaw in the tcmu package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.1High
Exploit odds (30 days)2.7%top 14.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12tcmu1.5.2-6DEBIAN-CVE-2021-3139
Debian:13tcmu1.5.2-6DEBIAN-CVE-2021-3139
Debian:14tcmu1.5.2-6DEBIAN-CVE-2021-3139
Ubuntu:22.04:LTStcmuno fix listedUBUNTU-CVE-2021-3139
Ubuntu:24.04:LTStcmuno fix listedUBUNTU-CVE-2021-3139
Ubuntu:25.10tcmuno fix listedUBUNTU-CVE-2021-3139
Ubuntu:26.04:LTStcmuno fix listedUBUNTU-CVE-2021-3139
Ubuntu:26.10tcmuno fix listedUBUNTU-CVE-2021-3139

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References