Skip to content
Fencer Vulns
high 8.1

CVE-2021-3139 json

In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer…

published 2021-01-13 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-26486

cvss
8.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.7%
EPSS 2.7% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.

Patch / fix

  • tcmu Debian 14, Debian 13, Debian 12 1.5.2-6

debian advisories DEBIAN-CVE-2021-3139

  • tcmu Ubuntu 20.04 LTS 1.5.2-5ubuntu0.20.04.1

ubuntu advisories UBUNTU-CVE-2021-3139

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ceph ceph storage 4 2:14.2.11-147.el7cp
  • ceph ceph storage 4 2:14.2.11-147.el8cp
  • librbd1 ceph storage 4 2:14.2.11-147.el7cp
  • librbd1 ceph storage 4 2:14.2.11-147.el8cp
  • librgw2 ceph storage 4 2:14.2.11-147.el7cp
  • librgw2 ceph storage 4 2:14.2.11-147.el8cp
  • libtcmu ceph storage 4 1.5.2-2.el7cp
  • libtcmu ceph storage 4 1.5.2-3.el8cp

red hat advisories RHSA-2021:1452RHSA-2021:1518

  • tcmu-runner SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +10 more 1.4.0-3.9.1
  • tcmu-runner Enterprise Storage 6 1.4.0-4.3.1
  • tcmu-runner SLE Module for Server Applications 15 SP2 1.5.2-3.3.1

suse advisories SUSE-SU-2021:0158-1SUSE-SU-2021:0143-1SUSE-SU-2021:0093-1

  • tcmu-runner openSUSE Leap 15.1 1.4.0-lp151.3.9.1
  • tcmu-runner openSUSE Leap 15.2 1.5.2-lp152.2.3.1

opensuse advisories openSUSE-SU-2021:0128-1openSUSE-SU-2021:0097-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-3139 updated cvss 8.1

tcmu-runner: SCSI target (LIO) write to any block on ILO backstore

  • Red Hat Openshift Container Storage 4 tcmu-runner
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ceph Storage 3 MON - ELS ceph 12.2.12-139.el7cp, librbd1 12.2.12-139.el7cp, librgw2 12.2.12-139.el7cp, ceph-mgr 12.2.12-139.el7cp, ceph-mon 12.2.12-139.el7cp, ceph-base 12.2.12-139.el7cp, +10 more Red Hat Ceph Storage 3 OSD - ELS ceph 12.2.12-139.el7cp, librbd1 12.2.12-139.el7cp, librgw2 12.2.12-139.el7cp, ceph-osd 12.2.12-139.el7cp, ceph-base 12.2.12-139.el7cp, ceph-test 12.2.12-139.el7cp, +9 more Red Hat Ceph Storage 3 Tools - ELS grafana 5.2.4-3.el7cp, ceph 12.2.12-139.el7cp, librbd1 12.2.12-139.el7cp, librgw2 12.2.12-139.el7cp, tcmu-runner 1.4.0-3.el7cp, ceph-mds 12.2.12-139.el7cp, +16 more
    fixed: vendor fix RHSA-2021:1518
  • Red Hat Ceph Storage 4.2 MON ceph 14.2.11-147.el7cp, ceph 14.2.11-147.el8cp, gperftools 2.6.3-3.el8cp, librbd1 14.2.11-147.el7cp, librbd1 14.2.11-147.el8cp, librgw2 14.2.11-147.el7cp, +40 more Red Hat Ceph Storage 4.2 OSD ceph 14.2.11-147.el7cp, ceph 14.2.11-147.el8cp, gperftools 2.6.3-3.el8cp, librbd1 14.2.11-147.el7cp, librbd1 14.2.11-147.el8cp, librgw2 14.2.11-147.el7cp, +28 more Red Hat Ceph Storage 4.2 Tools libtcmu 1.5.2-2.el7cp, libtcmu 1.5.2-3.el8cp, ceph 14.2.11-147.el7cp, ceph 14.2.11-147.el8cp, gperftools 2.6.3-3.el8cp, librbd1 14.2.11-147.el7cp, +42 more
    fixed: vendor fix RHSA-2021:1452
  • Red Hat Storage 3 libtcmu, tcmu-runner
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.68% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 5.5 AV:N/AC:L/Au:S/C:P/I:P/A:N

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.