CVE-2017-1304: Buffer Overflow
IBM has identified a vulnerability with IBM Spectrum Scale/GPFS utilized on the Elastic Storage Server (ESS)/GPFS Storage Server (GSS) during testing of an unsupported configuration, where users applications are running on an active ESS I/O server node and utilize direct I/O to perform a read or a write to a Spectrum Scale file. This vulnerability may result in the use of an incorrect memory address, leading to a Spectrum Scale/GPFS daemon failure with a Signal 11, and possibly leading to denial of service or undetected data corruption. IBM X-Force ID: 125458.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1304?
CVE-2017-1304 has a medium severity rating, indicating a moderate level of risk to users.
How do I fix CVE-2017-1304?
To fix CVE-2017-1304, users should upgrade to the latest supported version of IBM Elastic Storage Server.
What versions of IBM Elastic Storage Server are affected by CVE-2017-1304?
CVE-2017-1304 affects versions 2.0.0, 2.5.0, 2.5.5, 3.0.0, 3.0.5, 3.5.0, 3.5.6, 4.0.0, 4.0.6, 4.5.0, 4.6.0, 5.0.0, and 5.0.1 of IBM Elastic Storage Server.
What are the potential impacts of CVE-2017-1304?
The potential impacts of CVE-2017-1304 include exposure of user applications to data integrity and availability issues when running on affected I/O server nodes.
Is there a workaround for CVE-2017-1304?
There is no official workaround for CVE-2017-1304; upgrading to a secure version is recommended.