IBM Spectrum Scale 5.1 core / IBM Elastic Storage System 6.1: TENANT ISOLATION: unauthorized access to user data

Impact

TENANT ISOLATION: unauthorized access to user data, or injection of arbitrary data into the communication between cluster nodes. This is the core GPFS daemon protocol, not an add-on layer — an attacker positioned on the storage cluster network can read other tenants' data or write data that nodes accept as legitimate. For a shared training filesystem, data injection is also a training-data poisoning vector.

Who can reach it

An attacker with access to the inter-node communication path of the Spectrum Scale cluster — the back-end storage network.

What to do

Upgrade Spectrum Scale / ESS to a fixed level. This is a coordinated cluster upgrade; GPFS supports rolling node upgrades but the version-compatibility window means planning, and a full-cluster restart is sometimes unavoidable. Enable and verify GPFS cluster-level authentication and encryption in transit, which is a config change and the thing that actually removes the exposure.

References