Medium severity · published Jun 21, 2017
CVE-2017-1304
IBM has identified a vulnerability with IBM Spectrum Scale/GPFS utilized on the Elastic Storage Server (ESS)/GPFS Storage Server (GSS) during testing of an unsupported…
6.2
CVSS
0.4%
EPSS
No
On KEV
Description
IBM has identified a vulnerability with IBM Spectrum Scale/GPFS utilized on the Elastic Storage Server (ESS)/GPFS Storage Server (GSS) during testing of an unsupported configuration, where users applications are running on an active ESS I/O server node and utilize direct I/O to perform a read or a write to a Spectrum Scale file. This vulnerability may result in the use of an incorrect memory address, leading to a Spectrum Scale/GPFS daemon failure with a Signal 11, and possibly leading to denial of service or undetected data corruption. IBM X-Force ID: 125458.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Attack vector
Local
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Elastic Storage Server · Ibm
2.0.0; 2.5.0; 2.5.5; 3.0.0; 3.0.5; 3.5.0; +7 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-1304
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-1304
Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ssg1S1010230
Third Party Advisory
http://www.securityfocus.com/bid/99274
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/125458
More from Elastic Storage Server
8.4
CVE-2016-0392
IBM General Parallel File System (GPFS) in GPFS Storage Server 2.0.0 through 2.0.7 and Elastic Storage Server 2.5.x through 2.5.5, 3.x before 3.5.5, and 4.x before 4.0.3, as…
7.5
CVE-2020-5015
IBM Elastic Storage System 6.0.0 through 6.0.1.2 and IBM Elastic Storage Server 5.3.0 through 5.3.6.2 could allow a remote attacker to cause a denial of service by sending…
6.5
CVE-2020-4383
IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an authenticated user to cause a denial of service during deployment while configuring some of…
6.5
CVE-2020-4381
IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.6 could allow an authenticated user to cause a denial of service during deployment or upgrade if GUI specific…
5.5
CVE-2020-4756
IBM Spectrum Scale V4.2.0.0 through V4.2.3.23 and V5.0.0.0 through V5.0.5.2 as well as IBM Elastic Storage System 6.0.0 through 6.0.1.0 could allow a local attacker to invoke a…