PT-2024-29690 · Atos · Atos Eviden Smc Xscale

Published 2024-10-11 · Updated 2024-11-06 · CVE-2024-42018

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Atos Eviden SMC xScale versions prior to 1.6.6

Description An issue was discovered in Atos Eviden SMC xScale during initialization of nodes, where some configuration parameters are retrieved from management nodes. These parameters embed credentials whose integrity and confidentiality may be important to the security of the HPC configuration. Because these parameters are needed for initialization, there is no available mechanism to ensure access control on the management node, and a mitigation measure is normally put in place to prevent access to unprivileged users. It was discovered that this mitigation measure does not survive a reboot of diskful nodes. The mistake lies in the cloudinit configuration, where the iptables configuration should have been in the bootcmd instead of the runcmd section.

Recommendations For Atos Eviden SMC xScale versions prior to 1.6.6, update to version 1.6.6 or later to resolve the issue. As a temporary workaround, consider modifying the cloudinit configuration to move the iptables configuration from the runcmd section to the bootcmd section to prevent access to unprivileged users after a reboot.

Fix

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

CVE-2024-42018

Affected Products

Atos Eviden Smc Xscale

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-42018 · Security Note
• https://support.bull.com/ols/product/security/psirt/security-bulletins/misconfiguration-of-smc-xscale-leads-to-sensitive-data-exposure-psirt-1369-tlp-clear-version-2-6-cve-2024-42018/view · Note
• https://t.me/cvenotify/97887 · Telegram Post
• https://t.me/cvedetector/7716 · Telegram Post
• https://eviden.com · Note