GPU VulnDB

Database/Control plane, storage & DevOps

Lustre (mdt module, MDT Body eadatasize): An oversized eadatasize field in an MDT request drives the metadata server

CVE-2019-20430Control plane, storage & DevOpsLU-12602DDN EXAScalercurated

Impact

An oversized eadatasize field in an MDT request drives the metadata server into an LBUG panic. The MDS is the single point every file open goes through, so this is a full namespace outage for all tenants.

Who can reach it

Any Lustre client able to send MDT requests, i.e. any node with the filesystem mounted.

What to do

Upgrade Lustre to 2.12.3 or later on the metadata servers. Requires an MDS failover or reboot. If you run an active/passive MDS pair, patch the passive side first and fail over rather than taking a cold outage. DDN EXAScaler ships this Lustre code, so EXAScaler fleets inherit the issue and need DDN's corresponding release rather than an upstream build.

References

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.