PT-2019-6458 · Opensuse · Lustre
Publicado
2019-07-30
·
Atualizado
2020-01-29
·
CVE-2019-20425
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Lustre file system versions prior to 2.12.3
Description
The issue is related to the ptlrpc module in the Lustre file system, where a lack of validation for specific fields of packets sent by a client can lead to an out-of-bounds access and panic. Specifically, the function
lustre msg string does not validate a certain length value derived from lustre msg buflen v2. This can be exploited by a remote attacker to cause a denial of service.Recommendations
For versions prior to 2.12.3, update to version 2.12.3 or later to resolve the issue.
As a temporary workaround, consider restricting access to the
ptlrpc module to minimize the risk of exploitation.Exploit
Correção
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Lustre