CVE-2024-22430
📋 TL;DR
Dell PowerScale OneFS versions 8.2.x through 9.6.0.x have incorrect default permissions that allow local low-privileged users to cause denial of service. This affects Dell PowerScale storage systems running vulnerable OneFS versions. Attackers must have local access to exploit this vulnerability.
💻 Affected Systems
- Dell PowerScale OneFS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system unavailability through denial of service, disrupting storage operations for all users and applications.
Likely Case
Partial service disruption affecting specific storage operations or performance degradation.
If Mitigated
Minimal impact with proper access controls and monitoring in place.
🎯 Exploit Status
Exploitation requires local access with low privileges. No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 9.6.0.x (check Dell advisory for specific fixed versions)
Vendor Advisory: https://www.dell.com/support/kbdoc/en-us/000221707/dsa-2024-028-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
Restart Required: Yes
Instructions:
1. Review Dell advisory DSA-2024-028. 2. Download appropriate OneFS update from Dell Support. 3. Apply update following Dell's PowerScale update procedures. 4. Reboot system as required.
🔧 Temporary Workarounds
Restrict local user access
allLimit local user accounts and implement strict access controls to reduce attack surface.
# Review and remove unnecessary local user accounts
# Implement role-based access controls
# Monitor user privilege assignments
🧯 If You Can't Patch
- Implement strict access controls and monitor for suspicious local user activity.
- Segment network to isolate PowerScale systems from general user access.
🔍 How to Verify
Check if Vulnerable:
Check OneFS version via CLI: 'isi version' or web interface. If version is between 8.2.x and 9.6.0.x inclusive, system is vulnerable.Check Version:
isi versionVerify Fix Applied:
Verify OneFS version is updated beyond 9.6.0.x using 'isi version' command.📡 Detection & Monitoring
Log Indicators:
- Unexpected permission changes
- Denial of service events in system logs
- Multiple failed access attempts by local users
Network Indicators:
- Unusual storage access patterns
- Increased latency in storage operations
SIEM Query:
source="powerscale" AND (event_type="permission_change" OR event_type="dos_attempt")