Pure Storage FlashArray VASA provider: MULTI-TENANT ISOLATION: a vSphere or ESXi administrator with VASA access to a

Impact

MULTI-TENANT ISOLATION: a vSphere or ESXi administrator with VASA access to a FlashArray escalates to root on the array itself. A hypervisor admin, who should only be able to manage their own VMs' storage, ends up owning the array for every consumer of it.

Who can reach it

VMware admin rights against a FlashArray registered as a VASA provider. The trust path runs from the virtualization layer into the storage appliance.

What to do

Apply Pure's VASA security bulletin fix. Separately, reconsider whether the VASA registration should use a scoped service account rather than a broad one, so a hypervisor compromise does not reach array root.

References