PT-2020-10442 · Opensuse · Lustre

Published 2020-01-27 · Updated 2021-07-21 · CVE-2019-20430

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Lustre file system versions prior to 2.12.3

Description The issue is related to the mdt module in the Lustre file system, which can experience an LBUG panic due to the lack of validation for specific fields of packets sent by a client. This can be triggered by a large MDT Body eadatasize field.

Recommendations For versions prior to 2.12.3, update to version 2.12.3 or later to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-670

CWE-20

Related Identifiers

CVE-2019-20430

Affected Products

Lustre

References · 7

• 🔥 https://jira.whamcloud.com/browse/LU-12602 · Exploit
• http://wiki.lustre.org/Lustre_2.12.3_Changelog · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20430 · Security Note
• https://osv.dev/vulnerability/CVE-2019-20430 · Vendor Advisory
• http://lustre.org · Vendor Advisory
• https://t.me/cvenotify/436 · Telegram Post
• https://review.whamcloud.com/#/c/36208 · Note