CVE-2020-28374

What it actually does

Insufficient identifier validation in LIO SCSI target XCOPY handling permits directory traversal in backstore I/O proxying, allowing remote read or write of arbitrary files when an attacker controls at least one iSCSI LUN.

Why it matters to the business

Attackers who reach a single storage device can access or alter files elsewhere on the server, risking data exposure, tampering, or further compromise of Linux systems that expose iSCSI targets.

How an attack unfolds

An attacker with network access to one iSCSI LUN issues a crafted XCOPY request containing path traversal sequences in the identifier fields; the kernel proxies the I/O through an attacker-chosen backstore, bypassing intended access controls and enabling file read or write operations.

How to fix it

Upgrade the Linux kernel to 5.10.7 or newer; apply commit 2896c93811e39d63a4d9b63ccf12a8fbc226e5e4 in the target_core_xcopy.c code path. Restrict iSCSI exposure until patched.

How to confirm the fix worked

Verify running kernel version is 5.10.7 or later; inspect source for presence of commit 2896c93811e39d63a4d9b63ccf12a8fbc226e5e4; test that XCOPY requests with traversal sequences are rejected.

Typical attack path

1. Obtain network access to at least one iSCSI LUN
2. Craft and send XCOPY request containing directory traversal sequences
3. Select attacker-controlled backstore for I/O proxying
4. Read or write arbitrary files on the target system

How to detect it

Review kernel logs and iSCSI target logs for XCOPY operations, unexpected backstore selections, or path traversal patterns; correlate with network access logs to LUNs.

What your security team should do

• Apply kernel upgrade to 5.10.7+ containing the referenced commit as highest priority
• Limit iSCSI LUN exposure to trusted initiators only
• Audit and monitor XCOPY command traffic for anomalies
• Review downstream Linux distributions for backported fixes