CVE-2018-1495

Vulnerability

IBM FlashSystem V840 and V900 products (including FlashSystem 840 and 900) contain a vulnerability that allows an authenticated attacker with specialized access to overwrite arbitrary files, leading to a denial of service. Affected models and versions include FlashSystem 840 MTMs 9840-AE1 and 9843-AE1, FlashSystem 900 MTMs 9840-AE2 and 9843-AE2, and V840 storage nodes and controller nodes. For storage nodes, versions prior to 1.3.0.10 (1.3 stream), 1.4.8.0 (1.4 stream), and 1.5.1.1 (1.5 stream) are affected. For V840 controller nodes, versions prior to 7.7.1.9 (7.7 stream), 7.8.1.6 (7.8 stream), and 8.1.1.2 (8.1 stream) are affected [1][2].

Exploitation

To exploit this vulnerability, an attacker must be authenticated to the system and possess specialized access privileges. The vulnerability can be triggered remotely over the network (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The attacker requires no user interaction and can perform the attack with low complexity once authenticated. The specific sequence of steps is not disclosed in the references, but the authenticated attacker leverages their access to overwrite arbitrary files on the system [1][2].

Impact

A successful exploit allows the attacker to overwrite arbitrary files on the affected IBM FlashSystem device. This results in a denial of service (CIA impact: none on confidentiality or integrity, high on availability). The attacker cannot read data or modify system behavior in a targeted way, but the overwrite can render the system unavailable, affecting storage operations and potentially causing data access disruptions [1][2].

Mitigation

IBM has released fixes for all affected code streams. For FlashSystem 840 and 900, the fixes are available in VRMFs: 1.5.1.1 (1.5 stream), 1.4.8.0 (1.4 stream), and 1.3.0.10 (1.3 stream). For V840 storage nodes, the same VRMFs apply; for controller nodes, fixes are in VRMFs 8.1.1.2 (8.1 stream), 7.8.1.6 (7.8 stream), and 7.7.1.9 (7.7 stream). Customers are advised to upgrade to the fixed versions via IBM Fix Central. Note that the 1.3 code stream will no longer be supported for security fixes after this release. No workaround is provided [1][2].