Database/Control plane, storage & DevOps
Lustre (incorrect access control, 2.13.x-2.15.x before 2.15.4): TENANT ISOLATION: incorrect access control in Lustre
Impact
TENANT ISOLATION: incorrect access control in Lustre lets an attacker escalate privileges and obtain sensitive information. This is the modern-release equivalent of the 2019 family and it lands on the versions actually deployed in current AI-training clusters — 2.15.x is the long-term-support line most sites run today. On a shared training filesystem, 'obtain sensitive information' means another tenant's datasets, checkpoints and model weights.
Who can reach it
An attacker with Lustre client access on versions 2.13.x, 2.14.x, or 2.15.x before 2.15.4.
What to do
Upgrade to Lustre 2.15.4 or later — client and server packages, with a coordinated restart of the storage cluster. Enable Lustre nodemap with admin/trusted set to off for tenant clients and squash root, so a compromised client cannot act as root against the filesystem; that is a config change you can make ahead of the upgrade and it is the durable control.
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.