High severity8.1NVD Advisory· Published Jan 13, 2021· Updated Jun 17, 2026
CVE-2021-3139
CVE-2021-3139
Description
In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
19- cpe:2.3:a:tcmu-runner_project:tcmu-runner:*:*:*:*:*:*:*:*Range: >=1.3.0,<=1.5.2
- Range: 1.3.x, 1.4.x, and 1.5.x through 1.5.2
- Range: 1.3.x, 1.4.x, and 1.5.x through 1.5.2
- osv-coords16 versionspkg:rpm/opensuse/tcmu-runner&distro=openSUSE%20Leap%2015.1pkg:rpm/opensuse/tcmu-runner&distro=openSUSE%20Leap%2015.2pkg:rpm/suse/tcmu-runner&distro=SUSE%20Enterprise%20Storage%206pkg:rpm/suse/tcmu-runner&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOSpkg:rpm/suse/tcmu-runner&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/suse/tcmu-runner&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/tcmu-runner&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/tcmu-runner&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP2pkg:rpm/suse/tcmu-runner&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCLpkg:rpm/suse/tcmu-runner&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/tcmu-runner&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/tcmu-runner&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:rpm/suse/tcmu-runner&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/tcmu-runner&distro=SUSE%20Manager%20Proxy%204.0pkg:rpm/suse/tcmu-runner&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.0pkg:rpm/suse/tcmu-runner&distro=SUSE%20Manager%20Server%204.0
< 1.4.0-lp151.3.9.1+ 15 more
- (no CPE)range: < 1.4.0-lp151.3.9.1
- (no CPE)range: < 1.5.2-lp152.2.3.1
- (no CPE)range: < 1.4.0-4.3.1
- (no CPE)range: < 1.4.0-3.9.1
- (no CPE)range: < 1.4.0-3.9.1
- (no CPE)range: < 1.4.0-3.9.1
- (no CPE)range: < 1.4.0-3.9.1
- (no CPE)range: < 1.5.2-3.3.1
- (no CPE)range: < 1.4.0-3.9.1
- (no CPE)range: < 1.4.0-3.9.1
- (no CPE)range: < 1.4.0-3.9.1
- (no CPE)range: < 1.4.0-3.9.1
- (no CPE)range: < 1.4.0-3.9.1
- (no CPE)range: < 1.4.0-3.9.1
- (no CPE)range: < 1.4.0-3.9.1
- (no CPE)range: < 1.4.0-3.9.1
Patches
Vulnerability mechanics
References
5- github.com/open-iscsi/tcmu-runner/pull/644nvdPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2021/01/13/5nvdMailing ListMitigationThird Party Advisory
- bugzilla.suse.com/attachment.cginvdIssue TrackingThird Party Advisory
- bugzilla.suse.com/show_bug.cginvdIssue TrackingThird Party Advisory
- www.openwall.com/lists/oss-security/2021/01/12/12nvdMailing ListThird Party Advisory
News mentions
0No linked articles in our index yet.