CVE-2017-1304 Memory corruption in Elastic Storage Server

Medium 6.2 Published 21 Jun 2017 Updated 5 Aug 2024

Incorrect memory address usage in IBM Spectrum Scale during direct I/O operations can cause daemon crashes and potential data corruption.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-1304?

CVE-2017-1304 is a medium-severity memory corruption vulnerability in IBM Elastic Storage Server, published on 21 Jun 2017. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

IBM has identified a vulnerability with IBM Spectrum Scale/GPFS utilized on the Elastic Storage Server (ESS)/GPFS Storage Server (GSS) during testing of an unsupported configuration, where users applications are running on an active ESS I/O server node and utilize direct I/O to perform a read or a write to a Spectrum Scale file. This vulnerability may result in the use of an incorrect memory address, leading to a Spectrum Scale/GPFS daemon failure with a Signal 11, and possibly leading to denial of service or undetected data corruption. IBM X-Force ID: 125458.

Weakness: CWE-119

Which versions are affected by CVE-2017-1304?

It affects 1 product.

Products include Ibm Elastic Storage Server.

How do I fix CVE-2017-1304?

No fix has been published for CVE-2017-1304 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2017-1304 being exploited?

There is no known exploitation of CVE-2017-1304 in the wild and no public exploit code.

Sources

Also known as GHSA-mhfw-47p6-9px9.