KLA10487 Multiple vulnerabilities in IBM GPFS

Multiple serious vulnerabilities have been found in IBM GPFS. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, execute arbitrary code and gain privileges.

Below is a complete list of vulnerabilities

1. An unknown vulnerability can be exploited locally via a specially designed ioctl calls and other unknown vectors;
2. An unknown vulnerability can be exploited remotely via an unknown vectors.

Original advisories

IBM advisory

Related products

IBM-General-Parallel-File-System

CVE list

CVE-2015-0198 critical

CVE-2015-0199 warning

CVE-2015-0197 high

Solution

Update to latest version!

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• IBM General Parallel File System 3.4 versions earlier than 3.4.0.32IBM General Parallel File System 3.5 versions earlier than 3.5.0.24IBM General Parallel File System 4.1 versions earlier than 4.1.0.7