CVE-2021-21565 Denial of service in PowerScale OneFS
An attacker can trigger a loop in SmartConnect causing high CPU usage and preventing DNS responses, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-21565?
CVE-2021-21565 is a medium-severity denial of service vulnerability in Dell Powerscale Onefs, published on 2 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dell PowerScale OneFS versions 9.1.0.3 and earlier contain a denial of service vulnerability. SmartConnect had an error condition that may be triggered to loop, using CPU and potentially preventing other SmartConnect DNS responses.
Which versions are affected by CVE-2021-21565?
It affects 1 product.
Products include Dell Powerscale Onefs.
How do I fix CVE-2021-21565?
No fix has been published for CVE-2021-21565 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-21565 being exploited?
There is no known exploitation of CVE-2021-21565 in the wild and no public exploit code.
Other vulnerabilities in Dell Powerscale Onefs
Sources
Also known as GHSA-xxr9-34qv-3673.