CVE-2023-45084 Media caddy removal and reinsertion without reboot may cause data loss

High 7.0 Published 5 Dec 2023 Updated 2 Dec 2024

Physical drive caddy removal and reinsertion without reboot can trigger data loss due to a synchronization flaw in SoftIron HyperCloud storage nodes.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-45084?

CVE-2023-45084 is a high-severity vulnerability in SoftIron HyperCloud, published on 5 Dec 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

An issue exists in SoftIron HyperCloud where drive caddy removal and reinsertion without a reboot may erroneously cause the system to recognize the caddy as new media and wipe all data on the drives due to a missing synchronization flaw, which impacts data availability and integrity.

This issue only impacts SoftIron HyperCloud "density" storage nodes running HyperCloud software versions 1.0 to before 2.0.3.

Weakness: CWE-662, CWE-820

Which versions are affected by CVE-2023-45084?

It affects 1 product.

Products include Softiron Hypercloud.

How do I fix CVE-2023-45084?

No fix has been published for CVE-2023-45084 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-45084 being exploited?

There is no known exploitation of CVE-2023-45084 in the wild and no public exploit code.

Sources

Also known as GHSA-4rj3-h5c4-jprh.