CVE-2023-51786: Lustre: incorrect access control resulting in potential data compromise or privilege escalation

[daniel <sd () x17 eu>]

According to the post on the Lustre announce mailing list [1], a 
vulnerability has been fixed which provides access to files and folders 
for which a user has no permission for.

<quote>
Scope of Issue:
Users can gain access to files/folders in the filesystem that they 
should not have permission to access based on their user/group ID file 
access permissions, leading to potential data compromise or privilege 
escalation. This does not allow access to files that are outside a 
subdirectory mountpoint/nodemap that are not visible in the client 
mountpoint.
</quote>

Only specific combinations of Server, Client and Kernel are vulnerable.
The issue is mitigated by any of the following:

  1.  Disable User Namespaces (see below)
  2.  Upgrade all clients to a Lustre version including a fix (e.g.. 
2.15.4)
  3.  Upgrade servers to a Lustre version including a fix for this 
issue (e.g. 2.15.4)

A detailed description of how to disable user Namespaces is included in 
the original posting [1].

I was unable to pinpoint the exact change which fixed the issue. It is 
also noteworthy, that the issue was silently fixed.
Date of the fixed version 23 Dec 2023 and date of the security 
announcement 27 Feb 2024.

Affected versions:
Lustre Server version: 2.14 – 2.15.3
Lustre Client version: 2.12 – 2.15.3

References:
[1] 
http://lists.lustre.org/pipermail/lustre-announce-lustre.org/2024/000270.html
https://nvd.nist.gov/vuln/detail/CVE-2023-51786