DSA-2020-093: Dell EMC Isilon OneFS and Dell EMC PowerScale OneFS Security Update for NFS Configuration Vulnerabilities

Summary: Dell EMC Isilon OneFS and Dell EMC PowerScale OneFS remediation is available for NFS configuration vulnerability that could be exploited by malicious users to compromise the affected system. ...

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Impact

High

Details

Summary:   
The home directory within Dell EMC Isilon OneFS and Dell EMC PowerScale OneFS requires a remediation to address a vulnerability.

  • Incorrect Default Permissions Vulnerability 

CVE-2020-5353

The Dell Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 default configuration for Network File System (NFS) allows access to an 'admin' home directory. An attacker may leverage a spoofed Unique Identifier (UID) over NFS to rewrite sensitive files to gain administrative access to the system.

CVSS v3.1 Base Score: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

  • Incorrect Default Permissions Vulnerability 

CVE-2020-5353

The Dell Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 default configuration for Network File System (NFS) allows access to an 'admin' home directory. An attacker may leverage a spoofed Unique Identifier (UID) over NFS to rewrite sensitive files to gain administrative access to the system.

CVSS v3.1 Base Score: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Dell Technologies recommends all customers consider both the CVSS base score and any relevant temporal and environmental scores that may impact the potential severity associated with a particular security vulnerability.

Affected Products & Remediation

Affected products:    
Dell EMC Isilon OneFS versions 8.2.2 and earlier
Dell EMC PowerScale version 9.0.0

Remediation:     
For Dell EMC PowerScale OneFS version 9.0.0, the fix is contained in the release.
For Dell EMC Isilon OneFS version 8.2.2, the fix for this issue is included with the June 2020 Rollup Patch, as well as all future Rollup Patches. For more information and to obtain a Rollup patch, see the Current Isilon OneFS Patches document.
For Dell EMC Isilon OneFS version 8.2.1 and 8.1.2 the fix for this issue is included with the May 2020 Rollup Patch, as well as all future Rollup Patches.

Dell EMC recommends all customers upgrade at the earliest opportunity. 

Affected products:    
Dell EMC Isilon OneFS versions 8.2.2 and earlier
Dell EMC PowerScale version 9.0.0

Remediation:     
For Dell EMC PowerScale OneFS version 9.0.0, the fix is contained in the release.
For Dell EMC Isilon OneFS version 8.2.2, the fix for this issue is included with the June 2020 Rollup Patch, as well as all future Rollup Patches. For more information and to obtain a Rollup patch, see the Current Isilon OneFS Patches document.
For Dell EMC Isilon OneFS version 8.2.1 and 8.1.2 the fix for this issue is included with the May 2020 Rollup Patch, as well as all future Rollup Patches.

Dell EMC recommends all customers upgrade at the earliest opportunity. 

Workarounds & Mitigations

CVE ID Workaround and Mitigations
CVE-2020-5353

Mitigation is required for any cluster with an NFS configuration that allows access to the admin user’s home directory, such as:

  • A cluster upgraded to a remediated version, retaining the default NFS configuration from the original installation

Example: A cluster installed using OneFS 8.0.0 with the default NFS configuration, and later upgraded to OneFS 9.0.0.

  • A cluster installed on a version where the /ifs NFS export was manually created and the NFS service was enabled.

Example: A cluster installed using OneFS 9.0.0 where the NFS export for /ifs was manually created and the NFS service enabled.

Note: Fresh installations of clusters using any remediated version have the NFS service disabled by default, and no /ifs NFS export is created. These installations do not require additional mitigation.

 

Mitigation

Apply one of the recommended mitigation steps to remediate this vulnerability:

 

Option 1: Disable NFS

  • Open an SSH connection to any node in the cluster.
  • Log in as root.
  • Disable NFS by running the following command:
isi services nfs disable

      
 

      
Option 2: Move the Admin Home Directory

      
      
 

      
Option 3: Configure Kerberos Authentication for NFS Access

      
    
       
  • Refer to the following sections of the Product CLI Administration Guide:   
        
      
         
    • Authentication chapter, Managing MIT Kerberos authentication section.
      • 
         
    • File sharing chapter, Managing NFS Exports section.
      • 
        
    • 
      

      
     		
    

   
  

  
 


    
Acknowledgements

    

 
 
  
Dell would like to thank Knud from F-Secure for reporting this issue.

 


    
Related Information

    
Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide


        


        

        
Legal Disclaimer

        

        
Affected Products

        PowerScale OneFS
    
Products

        PowerScale OneFS, Product Security Information







                        

                            

    

        

            

                
                    
 Article Properties

                
            

            

                

                        
Article Number: 000153867

                

                
                

                        
Article Type: Dell Security Advisory

                

                

                        
Last Modified: 09 Apr 2026


                


            


        

    

    

        

            

                
                    
Find answers to your questions from other Dell users

                
            

            

                

                    
                



            


        

    

    

        

            

                
                    
Support Services

                
            

            

                

                    Check if your device is covered by Support Services.