Lustre (mdt module): Another unvalidated-field out-of-bounds access in the metadata server, ending in a panic. Same

Impact

Another unvalidated-field out-of-bounds access in the metadata server, ending in a panic. Same blast radius as the rest of the 2.12.3 batch - the shared namespace goes away for every tenant at once.

Who can reach it

Any Lustre client with LNet reachability to the MDS.

What to do

Upgrade Lustre servers to 2.12.3 or later. Treat the whole CVE-2019-20423 through CVE-2019-20432 family as one upgrade - they were all fixed in the same release and patching only the ones you have heard of leaves the rest live. DDN EXAScaler ships this Lustre code, so EXAScaler fleets inherit the issue and need DDN's corresponding release rather than an upstream build.

References