Vulnerability Details CVE-2019-20429
In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds read and panic (via a modified lm_bufcount field) due to the lack of validation for specific fields of packets sent by a client. This is caused by interaction between sptlrpc_svc_unwrap_request and lustre_msg_hdr_size_v2.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 70.2%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 7.8
References
Products affected by CVE-2019-20429
-
cpe:2.3:a:lustre:lustre:2.1.0
-
cpe:2.3:a:lustre:lustre:2.1.1
-
cpe:2.3:a:lustre:lustre:2.1.2
-
cpe:2.3:a:lustre:lustre:2.1.3
-
cpe:2.3:a:lustre:lustre:2.1.4
-
cpe:2.3:a:lustre:lustre:2.1.5
-
cpe:2.3:a:lustre:lustre:2.1.6
-
cpe:2.3:a:lustre:lustre:2.10.0
-
cpe:2.3:a:lustre:lustre:2.10.1
-
cpe:2.3:a:lustre:lustre:2.10.2
-
cpe:2.3:a:lustre:lustre:2.10.3
-
cpe:2.3:a:lustre:lustre:2.10.4
-
cpe:2.3:a:lustre:lustre:2.10.5
-
cpe:2.3:a:lustre:lustre:2.10.6
-
cpe:2.3:a:lustre:lustre:2.10.7
-
cpe:2.3:a:lustre:lustre:2.10.8
-
cpe:2.3:a:lustre:lustre:2.11.0
-
cpe:2.3:a:lustre:lustre:2.12.0
-
cpe:2.3:a:lustre:lustre:2.12.1
-
cpe:2.3:a:lustre:lustre:2.12.2
-
cpe:2.3:a:lustre:lustre:2.2.0
-
cpe:2.3:a:lustre:lustre:2.3.0
-
cpe:2.3:a:lustre:lustre:2.4.0
-
cpe:2.3:a:lustre:lustre:2.4.1
-
cpe:2.3:a:lustre:lustre:2.4.2
-
cpe:2.3:a:lustre:lustre:2.4.3
-
cpe:2.3:a:lustre:lustre:2.5.0
-
cpe:2.3:a:lustre:lustre:2.5.1
-
cpe:2.3:a:lustre:lustre:2.5.2
-
cpe:2.3:a:lustre:lustre:2.5.3
-
cpe:2.3:a:lustre:lustre:2.6.0
-
cpe:2.3:a:lustre:lustre:2.7.0
-
cpe:2.3:a:lustre:lustre:2.8.0
-
cpe:2.3:a:lustre:lustre:2.9.0