Skip to content

CVE-2021-3139

In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in...

8.1 HighFix available

In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

2.68%Up 1.1 points since Apr 14, 2021

What each source reports

NVD Score used 8.1

In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.

Record: CVE-2021-3139
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0: 5.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:N
Weakness: CWE-22
Updated: 2026-11-02

CVE List No score

In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.

Record: CVE-2021-3139
Updated: 2026-11-02

EUVDEUVD-2021-26486 No score

In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.

Record: EUVD-2021-26486
Updated: 2026-11-03

GitHub AdvisoriesGHSA-j364-gjm2-cwx8 No score

In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in...

In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.

Record: GHSA-j364-gjm2-cwx8
Weakness: CWE-22
Updated: 2026-11-02

OSV 8.1

In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.

Record: CVE-2021-3139
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2021-3139 8.1

In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.

Record: DEBIAN-CVE-2021-3139
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

Show 9 moreShow less

OSVRHSA-2021:1452 8.1

Red Hat Security Advisory: Red Hat Ceph Storage security, bug fix, and enhancement Update

Record: RHSA-2021:1452
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2021:1518 8.2

Red Hat Security Advisory: Red Hat Ceph Storage 3.3 Security and Bug Fix Update

Record: RHSA-2021:1518
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-3139 8.1

In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.

Record: UBUNTU-CVE-2021-3139
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVopenSUSE-SU-2021:0097-1 No score

Security update for tcmu-runner

This update for tcmu-runner fixes the following issues:

CVE-2021-3139: Fixed a LIO security issue (bsc#1180676).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record: openSUSE-SU-2021:0097-1
Updated: 2026-11-02

OSVopenSUSE-SU-2021:0128-1 No score

Security update for tcmu-runner

This update for tcmu-runner fixes the following issue:

CVE-2021-3139: Fixed a LIO security issue (bsc#1180676).

This update was imported from the SUSE:SLE-15:Update update project.

Record: openSUSE-SU-2021:0128-1
Updated: 2026-11-02

OSVSUSE-SU-2021:0093-1 No score

Security update for tcmu-runner

This update for tcmu-runner fixes the following issues:

CVE-2021-3139: Fixed a LIO security issue (bsc#1180676).

Record: SUSE-SU-2021:0093-1
Updated: 2026-11-02

OSVSUSE-SU-2021:0143-1 No score

Security update for tcmu-runner

This update for tcmu-runner fixes the following issue:

CVE-2021-3139: Fixed a LIO security issue (bsc#1180676).

Record: SUSE-SU-2021:0143-1
Updated: 2026-11-02

OSVSUSE-SU-2021:0158-1 No score

Security update for tcmu-runner

This update for tcmu-runner fixes the following issue:

CVE-2021-3139: Fixed a LIO security issue (bsc#1180676).

Record: SUSE-SU-2021:0158-1
Updated: 2026-11-02

OSVUSN-4707-1 No score

tcmu vulnerability

It was discovered that TCMU lacked a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request.

Record: USN-4707-1
Updated: 2026-11-02

Affected products

tcmu-runner project tcmu-runner

Affected packages

Affected packages
Package	Affected	Fixed
`tcmu` Debian:12	before 1.5.2-6	1.5.2-6
`tcmu` Debian:13	before 1.5.2-6	1.5.2-6
`tcmu` Debian:14	before 1.5.2-6	1.5.2-6
`ceph` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`ceph-base` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`ceph-common` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`ceph-debuginfo` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`ceph-grafana-dashboards` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`ceph-mgr` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`ceph-mgr-dashboard` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp

Show 148 moreShow less

Affected packages
Package	Affected	Fixed
`ceph-mgr-diskprediction-local` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`ceph-mgr-k8sevents` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`ceph-mgr-rook` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`ceph-mon` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`ceph-selinux` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`ceph-test` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`libcephfs-devel` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`libcephfs2` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`librados-devel` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`librados2` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`libradospp-devel` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`libradosstriper1` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`librbd-devel` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`librbd1` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`librgw-devel` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`librgw2` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`python-ceph-argparse` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`python-cephfs` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`python-rados` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`python-rbd` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`python-rgw` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`ceph-osd` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`ceph-ansible` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 0:4.0.49.2-1.el7cp	0:4.0.49.2-1.el7cp
`ceph-fuse` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`ceph-mds` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`ceph-radosgw` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`libtcmu` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 0:1.5.2-2.el7cp	0:1.5.2-2.el7cp
`rbd-mirror` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`rbd-nbd` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 2:14.2.11-147.el7cp	2:14.2.11-147.el7cp
`tcmu-runner` Red Hat:ceph_storage:4::el7 From an advisory covering 2 CVEs	before 0:1.5.2-2.el7cp	0:1.5.2-2.el7cp
`ceph` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-base` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-base-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-common` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-common-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-debugsource` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-fuse-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-grafana-dashboards` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-mds-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-mgr` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-mgr-dashboard` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-mgr-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-mgr-diskprediction-local` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-mgr-k8sevents` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-mgr-rook` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-mon` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-mon-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-osd-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-radosgw-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-selinux` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-test` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-test-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`gperftools` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 0:2.6.3-3.el8cp	0:2.6.3-3.el8cp
`gperftools-debugsource` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 0:2.6.3-3.el8cp	0:2.6.3-3.el8cp
`gperftools-libs` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 0:2.6.3-3.el8cp	0:2.6.3-3.el8cp
`gperftools-libs-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 0:2.6.3-3.el8cp	0:2.6.3-3.el8cp
`libcephfs-devel` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`libcephfs2` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`libcephfs2-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`librados-devel` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`librados-devel-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`librados2` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`librados2-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`libradospp-devel` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`libradosstriper1` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`libradosstriper1-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`librbd-devel` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`librbd1` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`librbd1-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`librgw-devel` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`librgw2` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`librgw2-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`python3-ceph-argparse` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`python3-cephfs` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`python3-cephfs-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`python3-rados` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`python3-rados-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`python3-rbd` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`python3-rbd-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`python3-rgw` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`python3-rgw-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`rbd-fuse-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`rbd-mirror-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`rbd-nbd-debuginfo` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-osd` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-ansible` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 0:4.0.49.2-1.el8cp	0:4.0.49.2-1.el8cp
`ceph-fuse` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-mds` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`ceph-radosgw` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`libtcmu` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 0:1.5.2-3.el8cp	0:1.5.2-3.el8cp
`rbd-mirror` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`rbd-nbd` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 2:14.2.11-147.el8cp	2:14.2.11-147.el8cp
`tcmu-runner` Red Hat:ceph_storage:4::el8 From an advisory covering 2 CVEs	before 0:1.5.2-3.el8cp	0:1.5.2-3.el8cp
`ceph` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`ceph-base` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`ceph-common` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`ceph-debuginfo` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`ceph-mgr` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`ceph-mon` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`ceph-selinux` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`ceph-test` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`libcephfs-devel` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`libcephfs2` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`librados-devel` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`librados2` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`libradosstriper1` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`librbd-devel` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`librbd1` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`librgw-devel` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`librgw2` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`python-cephfs` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`python-rados` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`python-rbd` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`python-rgw` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`ceph-osd` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`ceph-ansible` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 0:3.2.56-1.el7cp	0:3.2.56-1.el7cp
`ceph-fuse` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`ceph-mds` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`ceph-radosgw` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`cephmetrics` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 0:2.0.10-1.el7cp	0:2.0.10-1.el7cp
`cephmetrics-ansible` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 0:2.0.10-1.el7cp	0:2.0.10-1.el7cp
`grafana` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 0:5.2.4-3.el7cp	0:5.2.4-3.el7cp
`rbd-mirror` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 2:12.2.12-139.el7cp	2:12.2.12-139.el7cp
`tcmu-runner` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 0:1.4.0-3.el7cp	0:1.4.0-3.el7cp
`tcmu-runner-debuginfo` Red Hat:ceph_storage:3::el7 From an advisory covering 4 CVEs	before 0:1.4.0-3.el7cp	0:1.4.0-3.el7cp
`tcmu-runner` SUSE:Linux Enterprise Module for Server Applications 15 SP2	before 1.5.2-3.3.1	1.5.2-3.3.1
`tcmu-runner` SUSE:Enterprise Storage 6	before 1.4.0-4.3.1	1.4.0-4.3.1
`tcmu-runner` SUSE:Linux Enterprise High Performance Computing 15-ESPOS	before 1.4.0-3.9.1	1.4.0-3.9.1
`tcmu-runner` SUSE:Linux Enterprise High Performance Computing 15-LTSS	before 1.4.0-3.9.1	1.4.0-3.9.1
`tcmu-runner` SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS	before 1.4.0-3.9.1	1.4.0-3.9.1
`tcmu-runner` SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS	before 1.4.0-3.9.1	1.4.0-3.9.1
`tcmu-runner` SUSE:Linux Enterprise Server 15-LTSS	before 1.4.0-3.9.1	1.4.0-3.9.1
`tcmu-runner` SUSE:Linux Enterprise Server 15 SP1-BCL	before 1.4.0-3.9.1	1.4.0-3.9.1
`tcmu-runner` SUSE:Linux Enterprise Server 15 SP1-LTSS	before 1.4.0-3.9.1	1.4.0-3.9.1
`tcmu-runner` SUSE:Linux Enterprise Server for SAP Applications 15	before 1.4.0-3.9.1	1.4.0-3.9.1
`tcmu-runner` SUSE:Linux Enterprise Server for SAP Applications 15 SP1	before 1.4.0-3.9.1	1.4.0-3.9.1
`tcmu-runner` SUSE:Manager Proxy 4.0	before 1.4.0-3.9.1	1.4.0-3.9.1
`tcmu-runner` SUSE:Manager Retail Branch Server 4.0	before 1.4.0-3.9.1	1.4.0-3.9.1
`tcmu-runner` SUSE:Manager Server 4.0	before 1.4.0-3.9.1	1.4.0-3.9.1
`tcmu-runner` SUSE:Enterprise Storage 6	before 1.4.0-3.9.1	1.4.0-3.9.1
`tcmu` Ubuntu:20.04:LTS	before 1.5.2-5ubuntu0.20.04.1, plus listed versions 1.4.0-11.5.2-21.5.2-2ubuntu11.5.2-31.5.2-41.5.2-51.5.2-5build1	1.5.2-5ubuntu0.20.04.1
`tcmu` Ubuntu:22.04:LTS	All versions, plus listed versions 1.5.2-61.5.4-2	None known
`tcmu` Ubuntu:24.04:LTS	All versions, plus listed versions 1.5.4-4.11.5.4-51.5.4-6ubuntu1	None known
`tcmu` Ubuntu:25.10	All versions, plus listed versions 1.5.4-9	None known
`tcmu` Ubuntu:26.10	All versions, plus listed versions 1.5.4-10	None known
`tcmu` Ubuntu:26.04:LTS	All versions, plus listed versions 1.5.4-91.5.4-10	None known
`tcmu-runner` openSUSE:Leap 15.2	before 1.5.2-lp152.2.3.1	1.5.2-lp152.2.3.1
`tcmu-runner` openSUSE:Leap 15.1	before 1.4.0-lp151.3.9.1	1.4.0-lp151.3.9.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-3139 is a high vulnerability (CVSS 8.1) in Tcmu-runner Project Tcmu-runner, published January 13, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.68%, the 85th percentile. Fixed in tcmu 1.5.2-6.

References

Show 122 moreShow less