Dell SmartFabric Storage Software (restricted shell in SSH): OS command injection escaping the restricted shell of the

Impact

OS command injection escaping the restricted shell of the NVMe-oF fabric controller, from an authenticated remote user. Escaping the restricted shell gives full control of the appliance that enforces which host can attach to which NVMe namespace — the storage equivalent of owning the fabric's ACLs. Related CLI and path-traversal issues: CVE-2023-43069, CVE-2023-43070, CVE-2023-4401.

Who can reach it

Authenticated remote user with SSH access to SmartFabric Storage Software v1.4 or earlier.

What to do

Upgrade SmartFabric Storage Software past v1.4 — appliance software upgrade plus restart. Restrict SSH to a management bastion, and audit the NVMe-oF zoning/namespace-masking configuration afterwards rather than assuming the patch is sufficient.

References

Related entries

• GRUB2 (NTFS filesystem parser): Out-of-bounds write parsing a crafted NTFS volumeCVE-2023-4692 · GRUB2 (NTFS filesystem parser)High
• Phoenix SecureCore Technology 4 (boot splash screen image parsing): The firmware parses a user-supplied boot logo imageCVE-2023-5058 · Phoenix SecureCore Technology 4 (boot splash screen image parsing)High
• Linux kernel (drivers/infiniband/hw/hfi1): User SDMA requests with multiple payload buffers are read past the declaredCVE-2023-52474 · Linux kernel (drivers/infiniband/hw/hfi1)High
• Linux kernel (drivers/infiniband/ulp/ipoib): A PKEY child interface created over netlink comes up with multiple TX/RXCVE-2023-52745 · Linux kernel (drivers/infiniband/ulp/ipoib)High
• ASPEED video engine capture driver (drivers/media/platform/aspeed) - iKVM path: The video engine writes pastCVE-2023-52916 · ASPEED video engine capture driver (drivers/media/platform/aspeed) - iKVM pathHigh
• Linux kernel (drivers/infiniband/core): A 32-bit advance counter in the core RDMA block iterator wraps when a singleCVE-2023-53026 · Linux kernel (drivers/infiniband/core)High