IBM Spectrum Scale / Storage Scale core daemon (cluster RPC transport): An attacker who can speak to the cluster's

Impact

An attacker who can speak to the cluster's internal RPC transport reads user data out of the filesystem and can inject data into the protocol stream, with no credentials. On a shared training cluster this is a direct read of another tenant's datasets and checkpoints, and a path to corrupting them.

Who can reach it

Network reachability to the Storage Scale core daemon ports on any cluster node. No account and no filesystem mount is required, so anything that lands on the storage VLAN - a compromised compute node, a mis-scoped tenant network, a jump host - is enough.

What to do

Upgrade Storage Scale to 5.1.6.2 or later per IBM's bulletin, then confirm the cluster is running with the fixed daemon on every node. Until every node is upgraded, put the daemon ports behind an allowlist that only admits known cluster members and known client nodes.

References