Dell PowerStore T SDNAS: unauthenticated NFS/RPC buffer overflow allows command execution on the array

Impact

The SDNAS NFS/RPC path copies input without checking its size, and Dell states an unauthenticated remote attacker could reach command execution or denial of service. PowerStore T arrays commonly serve the NFS exports a GPU fleet mounts for datasets, checkpoints and home directories, so code execution on the array means read and write access to every tenant's data that lives on it, not just one node's. The denial-of-service half is nearly as expensive: an array outage stalls every training job with a mount on it, and those jobs do not recover gracefully. Dell scores attack complexity as high, so this is not a trivially sprayed exploit, but it needs no credentials.

Who can reach it

Anyone who can reach the SDNAS NFS/RPC service over the network — any host on the storage network, including a compromised compute node. No authentication required.

What to do

Dell DSA-2026-330 covers PowerStore T (500T, 1000T, 1200T, 3000T, 3200Q, 3200T, 5000T and related) and lists the fixed versions — take them from the advisory. A PowerStore code upgrade cycles the storage controllers, so plan it as an array maintenance window and expect NFS clients to see failover pauses; jobs with hard mounts will stall rather than fail, but check that before you start. Until patched, restrict which subnets can reach the NAS data ports.

References