CVE-2021-3139 Path traversal in n/a
Remote attackers with iSCSI LUN access can read or write arbitrary files via directory traversal in tcmu-runner XCOPY requests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-3139?
CVE-2021-3139 is a high-severity path traversal vulnerability in n/a, published on 13 Jan 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.
Weakness: CWE-22
Which versions are affected by CVE-2021-3139?
It affects 1 product.
Linux distribution packages (17)
tcmu-runner SUSE:Enterprise Storage 6 | All versions | 1.4.0-3.9.1 |
tcmu-runner SUSE:Enterprise Storage 6 | All versions | 1.4.0-4.3.1 |
tcmu-runner SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | All versions | 1.4.0-3.9.1 |
tcmu-runner SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 1.4.0-3.9.1 |
tcmu-runner SUSE:Linux Enterprise High Performance Computing 15-ESPOS | All versions | 1.4.0-3.9.1 |
tcmu-runner SUSE:Linux Enterprise High Performance Computing 15-LTSS | All versions | 1.4.0-3.9.1 |
tcmu-runner SUSE:Linux Enterprise Module for Server Applications 15 SP2 | All versions | 1.5.2-3.3.1 |
tcmu-runner SUSE:Linux Enterprise Server 15 SP1-BCL | All versions | 1.4.0-3.9.1 |
tcmu-runner SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 1.4.0-3.9.1 |
tcmu-runner SUSE:Linux Enterprise Server 15-LTSS | All versions | 1.4.0-3.9.1 |
tcmu-runner SUSE:Linux Enterprise Server for SAP Applications 15 | All versions | 1.4.0-3.9.1 |
tcmu-runner SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 1.4.0-3.9.1 |
tcmu-runner SUSE:Manager Proxy 4.0 | All versions | 1.4.0-3.9.1 |
tcmu-runner SUSE:Manager Retail Branch Server 4.0 | All versions | 1.4.0-3.9.1 |
tcmu-runner SUSE:Manager Server 4.0 | All versions | 1.4.0-3.9.1 |
tcmu-runner openSUSE:Leap 15.1 | All versions | 1.4.0-lp151.3.9.1 |
tcmu-runner openSUSE:Leap 15.2 | All versions | 1.5.2-lp152.2.3.1 |
Products include Tcmu-Runner Project Tcmu-Runner.
How do I fix CVE-2021-3139?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-3139 being exploited?
There is no known exploitation of CVE-2021-3139 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2021-3139, GHSA-j364-gjm2-cwx8, SUSE-SU-2021:0093-1, SUSE-SU-2021:0143-1, SUSE-SU-2021:0158-1, UBUNTU-CVE-2021-3139 and 3 more.