DSA-2021-180: Dell PowerScale OneFS Security Update for Multiple Vulnerabilities.
Résumé: Dell PowerScale OneFS remediation is available for multiple security vulnerabilities that may be exploited by malicious users to compromise the affected system.
Cet article concerne
Cet article ne concerne pas
Cet article n’est associé à aucun produit spécifique.
Toutes les versions du produit ne sont pas identifiées dans cet article.
Impact
Medium
Détails
| Proprietary Code CVE | Description | CVSS Base Score | CVSS Vector String |
| CVE-2021-36305 | Dell PowerScale OneFS contains an Unsynchronized Access to Shared Data in a Multithreaded Context in SMB CA handling. An authenticated user of SMB on a cluster with CA may potentially exploit this vulnerability, leading to a denial of service over SMB. | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| Third-party Component | CVE | More information |
| FreeBSD | CVE-2021-29626 | https://nvd.nist.gov/vuln/detail/CVE-2021-29626 In OneFS, a copy-on-write logic failed to invalidate shared memory page mappings between multiple processes which amy allow an unprivileged process to maintain a mapping after it is freed, allowing the process to read private data belonging to other processes or the kernel. |
| Proprietary Code CVE | Description | CVSS Base Score | CVSS Vector String |
| CVE-2021-36305 | Dell PowerScale OneFS contains an Unsynchronized Access to Shared Data in a Multithreaded Context in SMB CA handling. An authenticated user of SMB on a cluster with CA may potentially exploit this vulnerability, leading to a denial of service over SMB. | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| Third-party Component | CVE | More information |
| FreeBSD | CVE-2021-29626 | https://nvd.nist.gov/vuln/detail/CVE-2021-29626 In OneFS, a copy-on-write logic failed to invalidate shared memory page mappings between multiple processes which amy allow an unprivileged process to maintain a mapping after it is freed, allowing the process to read private data belonging to other processes or the kernel. |
Produits concernés et mesure corrective
| CVEs Addressed | Affected Versions | Updated Versions | Link to Update |
| CVE-2021-36305 | 8.2.0, 8.2.1, 9.0.0.x, 9.2.0.x, and 9.1.1.x | Upgrade your version of OneFS | PowerScale OneFS Downloads Area |
| 8.2.2, 9.1.0.x , and 9.2.1.x | Download and install the latest RUP | ||
| CVE-2021-29626 | 8.2.0, 8.2.1, 9.0.0.x, 9.2.0.x, and 9.1.1.x | Upgrade your version of OneFS | |
| 8.2.x, 9.1.0.x , and 9.2.1.x | Download and install the latest RUP |
| CVEs Addressed | Affected Versions | Updated Versions | Link to Update |
| CVE-2021-36305 | 8.2.0, 8.2.1, 9.0.0.x, 9.2.0.x, and 9.1.1.x | Upgrade your version of OneFS | PowerScale OneFS Downloads Area |
| 8.2.2, 9.1.0.x , and 9.2.1.x | Download and install the latest RUP | ||
| CVE-2021-29626 | 8.2.0, 8.2.1, 9.0.0.x, 9.2.0.x, and 9.1.1.x | Upgrade your version of OneFS | |
| 8.2.x, 9.1.0.x , and 9.2.1.x | Download and install the latest RUP |
Solutions de contournement et mesures d’atténuation
| Workarounds or Mitigations | |
| CVE-2021-36305 | Disabling Continuous Availability (CA) on all SMB shares that has it enabled prevents the issue. |
| CVE-2021-29626 | Disallow ISI_PRIV_LOGIN_CONSOLE and ISI_PRIV_LOGIN_SSH privileges to non-administrative users. |
Historique des révisions
| Revision | Date | Description |
| 1.0 | 30 Sep 2021 | Initial Release |
Informations connexes
Mention légale
Produits concernés
PowerScale OneFS, Product Security InformationPropriétés de l’article
Numéro d’article: 000192046
Type d’article: Dell Security Advisory
Dernière modification: 15 Feb 2022
Trouvez des réponses à vos questions auprès d’autres utilisateurs Dell
Services de support
Vérifiez si votre appareil est couvert par les services de support.