Lustre (ptlrpc module): Out-of-bounds write in the RPC layer, reachable by a client that lies about packet field sizes.

Impact

Out-of-bounds write in the RPC layer, reachable by a client that lies about packet field sizes. The server panics; on a shared parallel filesystem that is a cluster-wide storage outage, and an out-of-bounds write is always a candidate for something worse than a crash.

Who can reach it

Any host with LNet reachability to a Lustre server, i.e. any compute node in the fabric.

What to do

Upgrade Lustre servers to 2.12.3 or later and reload the Lustre modules, which means failing over or rebooting the affected OSS/MDS. Restricting LNet to trusted networks limits exposure but does not fix anything when tenants have their own nodes. DDN EXAScaler ships this Lustre code, so EXAScaler fleets inherit the issue and need DDN's corresponding release rather than an upstream build.

References