Security Bulletin: IBM Spectrum Scale and IBM GPFS are affected by security vulnerabilities (CVE-2016-2985 and CVE-2016-2984)

Summary

Security vulnerabilities have been identified in all levels of IBM Spectrum Scale and IBM GPFS that could allow:
- a local attacker to execute commands as root by setting environment variables processed by setuid programs (CVE-2016-2985)
- a local attacker to execute commands as root by supplying command line parameters to setuid programs (CVE-2016-2984)

Vulnerability Details

CVEID: CVE-2016-2985**
DESCRIPTION:** A security vulnerability has been identified in IBM Spectrum Scale and IBM GPFS that could allow a local attacker to execute commands as root by setting environment variables processed by setuid programs.
CVSS Base Score: 7.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114001 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID: CVE-2016-2984**
DESCRIPTION:** A security vulnerability has been identified in IBM Spectrum Scale and IBM GPFS that could allow a local attacker to execute commands as root by supplying command line parameters to setuid programs.
CVSS Base Score: 7.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114000 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

IBM Spectrum Scale V4.2.0.0 thru V4.2.0.3

IBM Spectrum Scale V4.1.1.0 thru V4.1.1.7

IBM GPFS V4.1.0.0 thru V4.1.0.8

IBM GPFS V3.5.0.0 thru V3.5.0.31

All older IBM GPFS versions no longer in service

Remediation/Fixes

For IBM Spectrum Scale V4.2.0.0 thru V4.2.0.3, apply IBM Spectrum Scale V4.2.0.4 available from Fix Central at
http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%2Bdefined%2Bstorage&product=ibm/StorageSoftware/IBM+Spectrum+Scale&release=4.2.0&platform=All&function=all

For IBM Spectrum Scale V4.1.1.0 thru 4.1.1.7 and IBM GPFS V4.1.0.0 thru V4.1.0.8, apply V4.1.1.8 at http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%2Bdefined%2Bstorage&product=ibm/StorageSoftware/IBM+Spectrum+Scale&release=4.1.1&platform=All&function=all

For IBM GPFS V3.5.0.0 thru V3.5.0.31, apply V3.5.0.32 at
http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=Cluster%2Bsoftware&product=ibm/power/IBM+General+Parallel+File+System&release=3.5.0&platform=All&function=all

For older versions of IBM GPFS, if you have an extended service contract, please contact IBM Service.

Workarounds and Mitigations

Until the fixes can be applied, a workaround is to remove the setuid from the files in the /usr/lpp/mmfs/bin directory. Determine the set of files with setuid bit by running

ls -l /usr/lpp/mmfs/bin | grep r-s

Then reset the setuid bit for each such file by issuing this command on each file

chmod u-sfile

Once the workaround is applied, a number of commands may no longer work when not invoked by unprivileged users, including:

mmchfileset mmcrsnapshot mmdelsnapshot mmdf mmedquota mmgetacl mmlsdisk mmlsfileset mmlsfs mmlsmgr mmlspolicy mmlspool mmlsquota mmlssnapshot mmputacl mmsnapdir