IBM Spectrum Scale 5.1 core / IBM Elastic Storage System 6.1: Unauthorized access to user data, or injection of

Impact

Unauthorized access to user data, or injection of arbitrary data into the communication between cluster nodes. This is the core GPFS daemon protocol, not an add-on layer — an attacker positioned on the storage cluster network can read other tenants' data or write data that nodes accept as legitimate. For a shared training filesystem, data injection is also a training-data poisoning vector.

Who can reach it

An attacker with access to the inter-node communication path of the Spectrum Scale cluster — the back-end storage network.

What to do

Upgrade Spectrum Scale / ESS to a fixed level. This is a coordinated cluster upgrade; GPFS supports rolling node upgrades but the version-compatibility window means planning, and a full-cluster restart is sometimes unavoidable. Enable and verify GPFS cluster-level authentication and encryption in transit, which is a config change and the thing that actually removes the exposure.

References