In the Lustre file system before 2.12.3, the ptlrpc module has a buffer overflow and panic due to the lack of validation for specific fields of packets sent by a client. The function target_handle_connect() mishandles a certain size value when a client connects to a server, because of an integer signedness error.
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Link | Tags |
---|---|
https://jira.whamcloud.com/browse/LU-12605 | third party advisory exploit |
https://review.whamcloud.com/#/c/35935/ | third party advisory |
http://wiki.lustre.org/Lustre_2.12.3_Changelog | release notes vendor advisory |
http://lustre.org/ | product vendor advisory |