CVE-2021-29740

IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.3 system core component is affected by a format string security vulnerability. An attacker could execute arbitrary code in the context of process memory, potentially escalating their system privileges and taking control over the entire system with root access. IBM X-Force ID: 201474.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/201474	VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/6457629	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/201474	VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/6457629	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:spectrum_scale::::::::
	cpe:2.3:a:ibm:spectrum_scale::::::::

History

21 Nov 2024, 06:01

Type	Values Removed	Values Added
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/201474 - VDB Entry, Vendor Advisory~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/201474 - VDB Entry, Vendor Advisory
References	~~() https://www.ibm.com/support/pages/node/6457629 - Vendor Advisory~~	() https://www.ibm.com/support/pages/node/6457629 - Vendor Advisory

Information

Published : 2021-06-01 14:15

Updated : 2024-11-21 06:01

NVD link : CVE-2021-29740

Mitre link : CVE-2021-29740

CVE.ORG link : CVE-2021-29740

JSON object : View

Products Affected

ibm

spectrum_scale

CWE

CWE-134

Use of Externally-Controlled Format String

{"id": "CVE-2021-29740", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2021-06-01T14:15:09.877", "references": [{"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/201474", "tags": ["VDB Entry", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://www.ibm.com/support/pages/node/6457629", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/201474", "tags": ["VDB Entry", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.ibm.com/support/pages/node/6457629", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-134"}]}], "descriptions": [{"lang": "en", "value": "IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.3 system core component is affected by a format string security vulnerability. An attacker could execute arbitrary code in the context of process memory, potentially escalating their system privileges and taking control over the entire system with root access. IBM X-Force ID: 201474."}, {"lang": "es", "value": "IBM Spectrum Scale versiones 5.0.0 hasta 5.0.5.6 y versiones 5.1.0 hasta 5.1.0.3, el componente system core est\u00e1 afectado por una vulnerabilidad de seguridad de cadena de formato. Un atacante podr\u00eda ejecutar c\u00f3digo arbitrario en el contexto de la memoria del proceso, escalando potencialmente los privilegios de su sistema y tomando el control de todo el sistema con acceso de root. IBM X-Force ID: 201474"}], "lastModified": "2024-11-21T06:01:43.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:spectrum_scale:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EFD2C84A-79C6-4986-AF5D-EABB5CDEA07D", "versionEndExcluding": "5.0.5.7", "versionStartIncluding": "5.0.0.0"}, {"criteria": "cpe:2.3:a:ibm:spectrum_scale:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "447D64FF-47EB-4793-B3F3-87713691C1EF", "versionEndExcluding": "5.1.1.0", "versionStartIncluding": "5.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}