Database/Control plane, storage & DevOps

Lustre (incorrect access control, 2.13.x-2.15.x before 2.15.4): Incorrect access control in Lustre lets an attacker

CVSS 9.1CVE-2023-51786Control plane, storage & DevOpscurated

Impact

Incorrect access control in Lustre lets an attacker escalate privileges and obtain sensitive information. This is the modern-release equivalent of the 2019 family and it lands on the versions actually deployed in current AI-training clusters — 2.15.x is the long-term-support line most sites run today. On a shared training filesystem, 'obtain sensitive information' means another tenant's datasets, checkpoints and model weights.

Who can reach it

An attacker with Lustre client access on versions 2.13.x, 2.14.x, or 2.15.x before 2.15.4.

What to do

Upgrade to Lustre 2.15.4 or later — client and server packages, with a coordinated restart of the storage cluster. Enable Lustre nodemap with admin/trusted set to off for tenant clients and squash root, so a compromised client cannot act as root against the filesystem; that is a config change you can make ahead of the upgrade and it is the durable control.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-51786

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.