tcmu-runner 1.3.x - 1.5.2 (userspace backstore handler for the Linux LIO target, used by Ceph iSCSI gateways and other

Impact

xcopy_locate_udev() does not enforce transport-layer restrictions, so an XCOPY (extended copy) request can name a source or destination by path traversal. An attacker who has been legitimately given one iSCSI LUN can therefore read or write files outside it - including other tenants' LUN backing files on the same target. This is the cleanest cross-tenant storage break in this set: no memory corruption, no crash, just a normal SCSI command that the target happily executes against the wrong tenant's data. It is the same mistake as CVE-2020-28374 in a different code path, so a target that patched only the earlier one is still exposed.

Who can reach it

An authenticated tenant with a single provisioned LUN on the affected target, issuing a crafted XCOPY over the normal iSCSI data path. No privilege escalation on the target and no access to the management network required.

What to do

Upgrade tcmu-runner past 1.5.2 - distro package update plus a restart of tcmu-runner, which briefly stalls I/O on the LUNs it backs but does not require a kernel reboot. Check what actually ships tcmu-runner in your stack: Ceph iSCSI gateway deployments and several appliance images vendor it, so the fixed version may need to come from the appliance vendor rather than the distro. Verify the fix covers both this and CVE-2020-28374; patching one code path was the original mistake. Until patched, disable XCOPY/ODX support on the target if your backstore allows it.

References