Dell PowerScale OneFS Security Update for Multiple Vulnerabilities [CVE-2021-36305 & CVE-2021-29626]

CVE numbers – CVE-2021-36305 and CVE-2021-29626

CVE-2021-36305

Dell PowerScale OneFS contains an Unsynchronized Access to Shared Data in a Multithreaded Context in SMB CA handling. An authenticated user of SMB on a cluster with CA may potentially exploit this vulnerability, leading to a denial of service over SMB.

To fix this issue Upgrade your version of OneFS – Download updates from – https://www.dell.com/support/home/en-ie/product-support/product/isilon-onefs/drivers

Workarounds or Mitigations

Disabling Continuous Availability (CA) on all SMB shares that has it enabled prevents the issue.

CVE-2021-29626

FreeBSD – In OneFS, a copy-on-write logic failed to invalidate shared memory page mappings between multiple processes which amy allow an unprivileged process to maintain a mapping after it is freed, allowing the process to read private data belonging to other processes or the kernel.

To fix this issue Upgrade your version of OneFS – Download updates from – https://www.dell.com/support/home/en-ie/product-support/product/isilon-onefs/drivers

Workarounds or Mitigations

Disallow ISI_PRIV_LOGIN_CONSOLE and ISI_PRIV_LOGIN_SSH privileges to non-administrative users.

Duncan Newell

Duncan is a technology professional with over 20 years experience of working in various IT roles. He has a interest in cyber security, and has a wide range of other skills in radio, electronics and telecommunications.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: