Database/Control plane, storage & DevOps

IBM Spectrum Scale / Storage Scale core daemon (cluster RPC transport): An attacker who can speak to the cluster's

CVSS 8.2CVE-2020-4927Control plane, storage & DevOpscurated

Impact

An attacker who can speak to the cluster's internal RPC transport reads user data out of the filesystem and can inject data into the protocol stream, with no credentials. On a shared training cluster this is a direct read of another tenant's datasets and checkpoints, and a path to corrupting them.

Who can reach it

Network reachability to the Storage Scale core daemon ports on any cluster node. No account and no filesystem mount is required, so anything that lands on the storage VLAN - a compromised compute node, a mis-scoped tenant network, a jump host - is enough.

What to do

Upgrade Storage Scale to 5.1.6.2 or later per IBM's bulletin, then confirm the cluster is running with the fixed daemon on every node. Until every node is upgraded, put the daemon ports behind an allowlist that only admits known cluster members and known client nodes.

References

https://www.ibm.com/support/pages/node/6960571 https://nvd.nist.gov/vuln/detail/CVE-2020-4927

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.