Vulnerability Details CVE-2019-20427
In the Lustre file system before 2.12.3, the ptlrpc module has a buffer overflow and panic, and possibly remote code execution, due to the lack of validation for specific fields of packets sent by a client. Interaction between req_capsule_get_size and tgt_brw_write leads to a tgt_shortio2pages integer signedness error.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.035
EPSS Ranking 87.1%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 9.0
References
Products affected by CVE-2019-20427
-
cpe:2.3:a:lustre:lustre:2.1.0
-
cpe:2.3:a:lustre:lustre:2.1.1
-
cpe:2.3:a:lustre:lustre:2.1.2
-
cpe:2.3:a:lustre:lustre:2.1.3
-
cpe:2.3:a:lustre:lustre:2.1.4
-
cpe:2.3:a:lustre:lustre:2.1.5
-
cpe:2.3:a:lustre:lustre:2.1.6
-
cpe:2.3:a:lustre:lustre:2.10.0
-
cpe:2.3:a:lustre:lustre:2.10.1
-
cpe:2.3:a:lustre:lustre:2.10.2
-
cpe:2.3:a:lustre:lustre:2.10.3
-
cpe:2.3:a:lustre:lustre:2.10.4
-
cpe:2.3:a:lustre:lustre:2.10.5
-
cpe:2.3:a:lustre:lustre:2.10.6
-
cpe:2.3:a:lustre:lustre:2.10.7
-
cpe:2.3:a:lustre:lustre:2.10.8
-
cpe:2.3:a:lustre:lustre:2.11.0
-
cpe:2.3:a:lustre:lustre:2.12.0
-
cpe:2.3:a:lustre:lustre:2.12.1
-
cpe:2.3:a:lustre:lustre:2.12.2
-
cpe:2.3:a:lustre:lustre:2.2.0
-
cpe:2.3:a:lustre:lustre:2.3.0
-
cpe:2.3:a:lustre:lustre:2.4.0
-
cpe:2.3:a:lustre:lustre:2.4.1
-
cpe:2.3:a:lustre:lustre:2.4.2
-
cpe:2.3:a:lustre:lustre:2.4.3
-
cpe:2.3:a:lustre:lustre:2.5.0
-
cpe:2.3:a:lustre:lustre:2.5.1
-
cpe:2.3:a:lustre:lustre:2.5.2
-
cpe:2.3:a:lustre:lustre:2.5.3
-
cpe:2.3:a:lustre:lustre:2.6.0
-
cpe:2.3:a:lustre:lustre:2.7.0
-
cpe:2.3:a:lustre:lustre:2.8.0
-
cpe:2.3:a:lustre:lustre:2.9.0