Security Bulletin
Summary
Security vulnerabilities have been identified in the current levels of IBM Spectrum Scale V4.1.1, IBM GPFS V4.1 and V3.5:
- could allow a local non privileged attacker to execute commands with root privileges (CVE-2015-4974)
- could allow a local non privileged attacker to read system memory contents (CVE-2015-4981)
IBM PureApplication System provides a GPFS pattern and addressed the applicable CVEs.
Vulnerability Details
CVEID: CVE-2015-4974
DESCRIPTION: IBM General Parallel File System could allow a local non privileged attacker to execute commands with root privileges.
CVSS Base Score: 8.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/105789 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2015-4981
DESCRIPTION: IBM General Parallel File System could allow a local non privileged attacker to read system memory contents
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/105831 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Affected Products and Versions
IBM PureApplication System V2.0 (GPFS Pattern type 1.2.0) using IBM GPFS V3.5.0.19
IBM PureApplication System V2.1 (GPFS Pattern type 1.2.1.0) using IBM GPFS V4.1.0.5
IBM PureApplication System V2.1.0.1 (GPFS Pattern type 1.2.2.0) using IBM GPFS V4.1.0.7
IBM PureApplication System V2.1.1 (GPFS Pattern type 1.2.3.0) using IBM GPFS V4.1.0.7
Remediation/Fixes
GPFS server or client instances deployed with the affected GPFS Pattern versions are vulnerable. To determine whether deployed GPFS sever or client instances are affected by these GPFS security vulnerabilities, run the Get Cluster Status operation ( for a GPFS server instance ) or the GPFS Client Status operation ( for a GPFS client instance ) to verify the version reported for the GPFS nodes. The instance is affected if the GPFS version is V4.1.0.5, V4.1.0.7 or V3.5.0.19.
The solution is to apply one of the following interim fixes or upgrade the PureApplication System to V2.1.2 or higher, and upgrade this instance using the pattern upgrade procedure.
GPFS 3.5.0.28
http://www-933.ibm.com/support/fixcentral/swg/downloadFixes?parent=PureSystems&product=ibm/WebSphere/PureApplication+System&release=2.0.0.1&platform=All&function=fixId&fixids=update-gpfs-3.5.0.28&includeRequisites=0&includeSupersedes=0&downloadMethod=http
GPFS 4.1.1.2
http://www-933.ibm.com/support/fixcentral/swg/downloadFixes?parent=PureSystems&product=ibm/WebSphere/PureApplication+System&release=2.1.1.0&platform=Linux&function=fixId&fixids=update-gpfs-4.1.1.2&includeRequisites=0&includeSupersedes=0&downloadMethod=http
The GPFS Pattern type 1.2.4.0 that is delivered with IBM PureApplication System V2.1.2.0 installs GPFS 4.1.1.2. Any instances deployed with this GPFS pattern type version or upgraded to this version will not be affected by these CVEs.
Whenever possible, the PureApplication System upgrade option is recommended instead of the interim fixes.
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Acknowledgement
None
Change History
7 January 2016: Original Version Published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
15 June 2018
UID
swg21974124