[<prev] [next>] [day] [month] [year] [list]
Message-ID: <32aa62ee-f364-45d2-a370-0e6963a31792@x17.eu>
Date: Tue, 12 Mar 2024 09:36:57 +0100
From: daniel <sd@....eu>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-51786: Lustre: incorrect access control resulting in
potential data compromise or privilege escalation
According to the post on the Lustre announce mailing list [1], a
vulnerability has been fixed which provides access to files and folders
for which a user has no permission for.
<quote>
Scope of Issue:
Users can gain access to files/folders in the filesystem that they
should not have permission to access based on their user/group ID file
access permissions, leading to potential data compromise or privilege
escalation. This does not allow access to files that are outside a
subdirectory mountpoint/nodemap that are not visible in the client
mountpoint.
</quote>
Only specific combinations of Server, Client and Kernel are vulnerable.
The issue is mitigated by any of the following:
1. Disable User Namespaces (see below)
2. Upgrade all clients to a Lustre version including a fix (e.g..
2.15.4)
3. Upgrade servers to a Lustre version including a fix for this
issue (e.g. 2.15.4)
A detailed description of how to disable user Namespaces is included in
the original posting [1].
I was unable to pinpoint the exact change which fixed the issue. It is
also noteworthy, that the issue was silently fixed.
Date of the fixed version 23 Dec 2023 and date of the security
announcement 27 Feb 2024.
Affected versions:
Lustre Server version: 2.14 – 2.15.3
Lustre Client version: 2.12 – 2.15.3
References:
[1]
http://lists.lustre.org/pipermail/lustre-announce-lustre.org/2024/000270.html
https://nvd.nist.gov/vuln/detail/CVE-2023-51786
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
