A security vulnerability has been identified in all levels of IBM Spectrum Scale and IBM GPFS that could allow a local attacker to inject commands into setuid file parameters and execute commands as root.
DESCRIPTION: IBM General Parallel File System could allow a local attacker to inject commands into setuid file parameters and execute commands as root.
CVSS Base Score: 8.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112611 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Products and Versions
IBM Spectrum Scale V126.96.36.199 thru V188.8.131.52
IBM Spectrum Scale V184.108.40.206 thru V220.127.116.11
IBM GPFS V18.104.22.168 thru V22.214.171.124
IBM GPFS V126.96.36.199 thru V188.8.131.52
All older IBM GPFS versions no longer in service
For IBM Spectrum Scale V184.108.40.206 thru V220.127.116.11, apply IBM Spectrum Scale V18.104.22.168 available from Fix Central at
For IBM Spectrum Scale V22.214.171.124 thru 126.96.36.199 and IBM GPFS V188.8.131.52 thru V184.108.40.206, apply V220.127.116.11 athttp://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%2Bdefined%2Bstorage&product=ibm/StorageSoftware/IBM+Spectrum+Scale&release=4.1.1&platform=All&function=all
For IBM GPFS V18.104.22.168 thru V22.214.171.124, apply V126.96.36.199 at
For older versions of IBM GPFS, if you have an extended service contract, please contact IBM Service.
Workarounds and Mitigations
Until the fixes can be applied, a workaround is to remove the setuid from the files in the /usr/lpp/mmfs/bin directory. Determine the set of files with setuid bit by running
ls -l /usr/lpp/mmfs/bin | grep r-s
Then reset the setuid bit for each such file by issuing this command on each file
chmod u-s file
Once the workaround is applied, a number of commands may no longer work when not invoked by unprivileged users, including:
Get Notified about Future Security Bulletins
This vulnerability was reported to IBM by John Fitzpatrick at MWR InfoSecurity
31 May 2016: Original version published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
25 June 2021