CVE-2024-47475
📋 TL;DR
Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.x have incorrect permissions on critical system resources. A local authenticated attacker could exploit this to cause denial of service by disrupting system operations. Only Dell PowerScale OneFS storage systems running affected versions are impacted.
💻 Affected Systems
- Dell PowerScale OneFS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system unavailability or data inaccessibility due to critical resource manipulation by a local attacker.
Likely Case
Partial service disruption affecting specific storage operations or performance degradation.
If Mitigated
Minimal impact with proper access controls limiting local user privileges.
🎯 Exploit Status
Exploitation requires local authenticated access. No public exploit code is known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply updates per Dell advisory DSA-2024-417
Vendor Advisory: https://www.dell.com/support/kbdoc/en-us/000242681/dsa-2024-417-security-update-for-dell-powerscale-onefs-for-security-vulnerability
Restart Required: Yes
Instructions:
1. Review Dell advisory DSA-2024-417. 2. Download appropriate OneFS update from Dell Support. 3. Apply update following Dell PowerScale update procedures. 4. Reboot system as required.
🔧 Temporary Workarounds
Restrict Local User Access
linuxLimit local user accounts and privileges to essential personnel only.
Review and remove unnecessary local accounts using OneFS user management tools
🧯 If You Can't Patch
- Implement strict access controls limiting local user privileges to minimum required.
- Monitor system logs for unusual local user activity or resource access patterns.
🔍 How to Verify
Check if Vulnerable:
Check OneFS version with command: 'isi version'. If version is between 8.2.2.x and 9.8.0.x inclusive, system is vulnerable.Check Version:
isi versionVerify Fix Applied:
Verify updated version with 'isi version' and confirm it's above affected range. Check Dell advisory for specific fixed versions.📡 Detection & Monitoring
Log Indicators:
- Unusual local user activity accessing system resources
- Permission modification events in system logs
- Denial of service alerts from PowerScale monitoring
Network Indicators:
- Increased failed storage requests from dependent systems
- Unusual management interface activity
SIEM Query:
source="powerscale" AND (event_type="permission_change" OR event_type="resource_access" OR event_type="dos_alert")