CVE-2020-5347 Denial of service in Isilon OneFS
An attacker can trigger a loop in SmartConnect, causing high CPU usage and preventing DNS responses, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-5347?
CVE-2020-5347 is a medium-severity denial of service vulnerability in Dell Isilon OneFS, published on 3 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dell EMC Isilon OneFS versions 8.2.2 and earlier contain a denial of service vulnerability. SmartConnect had an error condition that may be triggered to loop, using CPU and potentially preventing other SmartConnect DNS responses.
Weakness: CWE-400
Which versions are affected by CVE-2020-5347?
It affects 1 product.
Products include Dell Emc Isilon Onefs.
How do I fix CVE-2020-5347?
No fix has been published for CVE-2020-5347 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-5347 being exploited?
There is no known exploitation of CVE-2020-5347 in the wild and no public exploit code.
Other vulnerabilities in Dell Isilon OneFS
Sources
Also known as GHSA-rmjc-gxcm-fvf5.