IBM Support

Security Bulletin: IBM General Parallel File System is affected by security vulnerabilities (CVE-2015-0197, CVE-2015-0198, CVE-2015-0199)

Security Bulletin


Summary

Security vulnerabilities have been identified in current levels of GPFS V4.1, V3.5, and V3.4:
- could allow a local attacker which only has a non-privileged account to execute programs with root privileges (CVE-2015-0197)
- may not properly authenticate network requests and could allow an attacker to execute programs remotely with root privileges (CVE-2015-0198)
- allows attackers to cause kernel memory corruption by issuing specific ioctl calls to a character device provided by the mmfslinux kernel module and cause a denial of service (CVE-2015-0199)

Vulnerability Details


CVEID: CVE-2015-0197
DESCRIPTION:
IBM General Parallel File System could allow a local attacker which only has a non-privileged account to execute programs with root privileges.
CVSS Base Score: 6.9
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/101224 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:M/Au:N/C:C/I:C/A:C)

CVEID: CVE-2015-0198
DESCRIPTION:
IBM General Parallel File System may not properly authenticate network requests and could allow an attacker to execute programs remotely with root privileges.
CVSS Base Score: 9.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/101225 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVEID: CVE-2015-0199
DESCRIPTION:
IBM General Parallel File System allows attackers to cause kernel memory corruption by issuing specific ioctl calls to a character device provided by the mmfslinux kernel module and cause a denial of service.
CVSS Base Score: 4.7
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/101226 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:M/Au:N/C:N/I:N/A:C)

Affected Products and Versions

GPFS V4.1.0.0 thru GPFS V4.1.0.6

GPFS V3.5.0.0 thru GPFS V3.5.0.23

GPFSV3.4.0.0 thru GPFSV3.4.0.31

For CVE-2015-0198, you are not affected if either of the following are true:

  • the cipherList configuration variable is set to AUTHONLY or to a cipher
or
  • only trusted nodes/processes/users can initiate connections to GPFS nodes

Remediation/Fixes


Apply GPFS 4.1.0.7 , GPFS V3.5.0.24 ,or GPFS V3.4.0.32 as appropriate for your level of GPFS available from Fix Central at http://www-933.ibm.com/support/fixcentral/ .

For CVE-2015-0198, after applying the appropriate PTF, set cipherList to AUTHONLY.

To enable AUTHONLY without shutting down the daemon on all nodes:

  • Install the PTF containing the fix on all nodes in the cluster one node at a time
  • Generate SSL keys by running the mmauth genkey new command. This step is not needed if CCR is in effect (GPFS 4.1 only)
  • Enable AUTHONLY by running the mmauth update . -l AUTHONLY command. If the mmauth update command fails, examine the messages, correct the problems (or shut down the daemon on the problem node) and repeat the mmauth update command above.

Note: Applying the PTF for your level of GPFS (GPFS 4.1.0.7 , GPFSV3.5.0.24 , or GPFS V3.4.0.32) on all nodes in the cluster will allow you to switch cipherList dynamically without shutting down the GPFS daemons across the cluster. The mitigation step below will require all nodes in the cluster to be shut down.

If there are any nodes running GPFS 3.4 on Windows then switching the cipherList dynamically is only possible in one of the following two scenarios:
  • The mmauth update command is initiated from one of the GPFS 3.4 Windows nodes
or
  • If the command is issued from another node in the cluster then GPFS must be down on all the GPFS 3.4 Windows nodes

Workarounds and Mitigations


For CVE-2015-0197 and CVE-2015-0199, there are no workarounds or mitigations.

For CVE-2015-0198, set cipherList to AUTHONLY, or to a real cipher. Follow the instructions above if the PTF was installed on all the nodes in the cluster. Otherwise:

  • Generate SSL keys by running the mmauth genkey new command
  • Shut down the GPFS daemon on all nodes on the cluster
  • Enable AUTHONLY by running mmauth update . -l AUTHONLY

Get Notified about Future Security Bulletins

References

Off

Acknowledgement

The vulnerabilities were reported to IBM by Florian Grunow and Felix Wilhelm of ERNW

Change History

modified expiration date

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

[{"Product":{"code":"SG6MSP","label":"General Parallel File System"},"Business Unit":{"code":"BU010","label":"Systems - Storage"},"Component":"--","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"","label":"System x"},{"code":"PF033","label":"Windows"}],"Version":"3.5.0;3.4.0;4.1.0","Edition":""}]

Document Information

Modified date:
07 August 2018

UID

isg3T1022062