Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-20427: Lustre File System Buffer Overflow Allows Remote Code Execution

CVE-2019-20427 · published 6 years ago

Summary

The Lustre file system has a buffer overflow bug that could allow hackers to execute code remotely. This issue affects all versions of Lustre before 2.12.3. To protect your system, update to version 2.12.3 or later.

What to do

Update lustre lustre to version 2.12.3 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Ubuntu:Pro:14.04:LTS	canonical	linux	All versions
Ubuntu:Pro:14.04:LTS	canonical	linux-aws	All versions
Ubuntu:Pro:14.04:LTS	canonical	linux-azure	All versions
Ubuntu:Pro:14.04:LTS	canonical	linux-lts-xenial	All versions
Ubuntu:16.04:LTS	canonical	linux-hwe-edge	All versions
Ubuntu:18.04:LTS	canonical	linux-azure-edge	All versions
Ubuntu:18.04:LTS	canonical	linux-gcp-edge	All versions
Ubuntu:18.04:LTS	canonical	linux-hwe-edge	All versions
–	lustre	lustre	< 2.12.3 `cpe:2.3:a:lustre:lustre::::::::`

Original advisory text

In the Lustre file system before 2.12.3, the ptlrpc module has a buffer overflow and panic, and possibly remote code execution, due to the lack of validation for specific fields of packets sent by a client. Interaction between req_capsule_get_size and tgt_brw_write leads to a tgt_shortio2pages integer signedness error.

References

https://ubuntu.com/security/CVE-2019-20427 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-20427 Third Party Advisory
http://lustre.org/ Third Party Advisory
http://wiki.lustre.org/Lustre_2.12.3_Changelog Third Party Advisory
https://jira.whamcloud.com/browse/LU-12600 Third Party Advisory
https://review.whamcloud.com/#/c/35867/ Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

5% chance of attack within 30 days

Type

CWE-120Classic Buffer Overflow

Timeline

Published27 Jan 2020

Updated3 Nov 2026

First seen14 Apr 2026

Sources

UBUNTU-CVE-2019-20427 · OSV

CVE-2019-20427 · NVD

Track software like this

Free during beta