Lustre ptlrpc module (server-side client packet validation): A Lustre client can send a crafted RPC that overflows a

Impact

A Lustre client can send a crafted RPC that overflows a buffer in the server's ptlrpc module, panicking it and possibly achieving remote code execution on the storage server. On a Lustre cluster the client is the tenant's GPU node — Lustre's security model assumes clients are trusted, and this is what that assumption costs. Code execution on an MDS or OSS is access to every tenant's data on the filesystem, and a panic takes the shared filesystem down for every running job.

Who can reach it

Any Lustre client — i.e. any compute node with the filesystem mounted, which in a rented GPU cluster means the tenant's own machine. No privilege escalation needed on the client beyond the ability to send RPCs.

What to do

Upgrade Lustre servers to 2.12.3 or later. This is a coordinated storage-cluster upgrade: MDS and OSS nodes need the new build and a restart, and while Lustre supports failover pairs, most sites take an I/O pause. Structurally, treat the Lustre network (LNet) as a boundary: put it on a dedicated fabric that tenant workloads cannot address arbitrarily, and use Lustre nodemap/Shared-Secret Key authentication rather than relying on client trust.

References

Related entries

• NetApp ONTAP Select Deploy administration utility (HTTP service): An unauthenticated attacker performs administrativeCVE-2019-5504 · NetApp ONTAP Select Deploy administration utility (HTTP service)Critical
• NetApp ONTAP Select Deploy administration utility (credential transport): Deploy sends its credentials in plaintext, soCVE-2019-5505 · NetApp ONTAP Select Deploy administration utility (credential transport)Critical
• NetApp ONTAP Select Deploy administration utility (code injection): An unauthenticated remote attacker injects code andCVE-2019-5509 · NetApp ONTAP Select Deploy administration utility (code injection)Critical
• Slurm (32-bit RPC handling): Memory corruption on 32-bit Slurm builds reachable from a crafted RPC, up to control ofCVE-2019-6438 · Slurm (32-bit RPC handling)Critical
• Optergy Proton / Enterprise building management platform: A backdoor console giving remote root code executionCVE-2019-7276 · Optergy Proton / Enterprise building management platformCritical
• Delta Controls enteliBUS Manager (eBMGR) V3.40_B-571848, dactetra service: Unauthenticated remote code executionCVE-2019-9569 · Delta Controls enteliBUS Manager (eBMGR) V3.40_B-571848, dactetra serviceCritical