IBM Spectrum Scale container image (command execution): A local attacker runs arbitrary commands inside the Spectrum

Impact

A local attacker runs arbitrary commands inside the Spectrum Scale container, which is the process that brokers filesystem access for everything scheduled on that node.

Who can reach it

Local, low-privileged access to a node running Spectrum Scale 5.1.0.1 through 5.1.4.1 in container form.

What to do

Pull the fixed Storage Scale container image per IBM's bulletin and redeploy the DaemonSet. Confirm the running image digest afterwards rather than trusting the tag.

References