Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 12 Mar 2024 09:36:57 +0100
From: daniel <>
Subject: CVE-2023-51786: Lustre: incorrect access control resulting in
 potential data compromise or privilege escalation

According to the post on the Lustre announce mailing list [1], a 
vulnerability has been fixed which provides access to files and folders 
for which a user has no permission for.

Scope of Issue:
Users can gain access to files/folders in the filesystem that they 
should not have permission to access based on their user/group ID file 
access permissions, leading to potential data compromise or privilege 
escalation. This does not allow access to files that are outside a 
subdirectory mountpoint/nodemap that are not visible in the client 

Only specific combinations of Server, Client and Kernel are vulnerable.
The issue is mitigated by any of the following:

   1.  Disable User Namespaces (see below)
   2.  Upgrade all clients to a Lustre version including a fix (e.g.. 
   3.  Upgrade servers to a Lustre version including a fix for this 
issue (e.g. 2.15.4)

A detailed description of how to disable user Namespaces is included in 
the original posting [1].

I was unable to pinpoint the exact change which fixed the issue. It is 
also noteworthy, that the issue was silently fixed.
Date of the fixed version 23 Dec 2023 and date of the security 
announcement 27 Feb 2024.

Affected versions:
Lustre Server version: 2.14 – 2.15.3
Lustre Client version: 2.12 – 2.15.3


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.