CVE-2019-20423 | BDVDB-2026-129809 Detail

Description#

In the Lustre file system before 2.12.3, the ptlrpc module has a buffer overflow and panic due to the lack of validation for specific fields of packets sent by a client. The function target_handle_connect() mishandles a certain size value when a client connects to a server, because of an integer signedness error.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://jira.whamcloud.com/browse/LU-12605
https://review.whamcloud.com/#/c/35935/
http://wiki.lustre.org/Lustre_2.12.3_Changelog
http://lustre.org/

Exploit#

No public exploit known

History#

Version 12020-01-27Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.