Dell CloudLink (risky cryptographic primitive): Use of a cryptographic primitive with a risky implementation

Impact

Use of a cryptographic primitive with a risky implementation, exploitable by a high-privileged attacker for denial of service of the key manager. If CloudLink is down, encrypted volumes do not unlock - this is an availability risk to the storage tier.

Who can reach it

Local high-privilege access on the appliance.

What to do

Upgrade CloudLink to 8.2. Make sure you have tested the KMS-unavailable failure mode for your storage estate.

References