What is CVE-2017-1304?

CVE-2017-1304 is a medium-severity vulnerability in IBM Elastic Storage Server, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 6.2/10. Published 2017-06-21.

How severe is CVE-2017-1304?

Medium severity. CVSS v3 base score is 6.2 out of 10.

Buffer overflow in IBM Elastic Storage Server

CVE-2017-1304

IBM has identified a vulnerability with IBM Spectrum Scale/GPFS utilized on the Elastic Storage Server (ESS)/GPFS Storage Server (GSS) during testing of an unsupported configuration, where users applications are running on an active ESS I/O server node and utilize direct I/O to perform a read or a write to a Spectrum Scale file. This vulnerability may result in the use of an incorrect memory address, leading to a Spectrum Scale/GPFS daemon failure with a Signal 11, and possibly leading to denial of service or undetected data corruption. IBM X-Force ID: 125458.

Vulnerability class: Buffer Overflow

EPSS: 0.004 (31.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.2 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H.

Affected products

Ibm Elastic Storage Server — versions 4.0, 2.0, 3.0
Ibm Elastic_storage_server — versions 2.0.0, 2.5.0, 2.5.5

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

psirt@us.ibm.com (VDB Entry, x_refsource_MISC, Vendor Advisory)
psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)
psirt@us.ibm.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)

Frequently asked questions

What is CVE-2017-1304?: CVE-2017-1304 is a medium-severity vulnerability in IBM Elastic Storage Server, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 6.2/10. Published 2017-06-21.
How severe is CVE-2017-1304?: Medium severity. CVSS v3 base score is 6.2 out of 10.