CVE-2020-4411

The Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.3 file system component is affected by a denial of service vulnerability in its kernel module that could allow an attacker to cause a denial of service condition on the affected system. To exploit this vulnerability, a local attacker could invoke a subset of ioctls on the Spectrum Scale device with non-valid arguments. This could allow the attacker to crash the kernel. IBM X-Force ID: 179986.

CVSS v3 7.1 HIGH
CVSS v2.0 4.9 MEDIUM

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 4.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

4.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 3.9 / Impact : 6.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/179986	VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/6209002	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/179986	VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/6209002	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:ibm:spectrum_scale::::::::
	cpe:2.3:a:ibm:spectrum_scale::::::::

OR	cpe:2.3:o:ibm:aix:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*

History

21 Nov 2024, 05:32

Type	Values Removed	Values Added
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/179986 - VDB Entry, Vendor Advisory~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/179986 - VDB Entry, Vendor Advisory
References	~~() https://www.ibm.com/support/pages/node/6209002 - Vendor Advisory~~	() https://www.ibm.com/support/pages/node/6209002 - Vendor Advisory

Information

Published : 2020-05-19 14:15

Updated : 2024-11-21 05:32

NVD link : CVE-2020-4411

Mitre link : CVE-2020-4411

CVE.ORG link : CVE-2020-4411

JSON object : View

Products Affected

ibm

aix
spectrum_scale

linux

linux_kernel

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2020-4411", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.5}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.5}]}, "published": "2020-05-19T14:15:11.597", "references": [{"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/179986", "tags": ["VDB Entry", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://www.ibm.com/support/pages/node/6209002", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/179986", "tags": ["VDB Entry", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.ibm.com/support/pages/node/6209002", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.3 file system component is affected by a denial of service vulnerability in its kernel module that could allow an attacker to cause a denial of service condition on the affected system. To exploit this vulnerability, a local attacker could invoke a subset of ioctls on the Spectrum Scale device with non-valid arguments. This could allow the attacker to crash the kernel. IBM X-Force ID: 179986."}, {"lang": "es", "value": "El componente filesystem de Spectrum Scale versiones 4.2.0.0 hasta 4.2.3.21 y versiones 5.0.0.0 hasta 5.0.4.3, est\u00e1 afectado por una vulnerabilidad de denegaci\u00f3n de servicio en su m\u00f3dulo kernel que podr\u00eda permitir a un atacante causar una condici\u00f3n de denegaci\u00f3n de servicio en el sistema afectado. Para explotar esta vulnerabilidad, un atacante local podr\u00eda invocar un subconjunto de ioctls en el dispositivo Spectrum Scale con argumentos no v\u00e1lidos. Esto podr\u00eda permitir a un atacante bloquear el kernel. IBM X-Force ID: 179986."}], "lastModified": "2024-11-21T05:32:42.543", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:spectrum_scale:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E1B6552-CECC-4F3A-A785-B32048798C99", "versionEndIncluding": "4.2.3.21", "versionStartIncluding": "4.2.0.0"}, {"criteria": "cpe:2.3:a:ibm:spectrum_scale:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A2908F78-BC39-4C1B-A83F-AFCA284F7498", "versionEndIncluding": "5.0.4.3", "versionStartIncluding": "5.0.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E492C463-D76E-49B7-A4D4-3B499E422D89"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@us.ibm.com"}