CVE-2016-2985

HIGH

IBM Spectrum Scale and General Parallel File System - Privilege Escalation via Environment Variable Injection

Title source: llm
STIX 2.1

Description

IBM Spectrum Scale 4.1.1.x before 4.1.1.8 and 4.2.x before 4.2.0.4 and General Parallel File System (GPFS) 3.5.x before 3.5.0.32 and 4.1.x before 4.1.1.8 allow local users to gain privileges via crafted environment variables to a /usr/lpp/mmfs/bin/ setuid program.

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/92408

Scores

CVSS v3 7.0
EPSS 0.0030
EPSS Percentile 21.7%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-264
Status published
Products (50)
ibm/general_parallel_file_system 3.5.0.0
ibm/general_parallel_file_system 3.5.0.1
ibm/general_parallel_file_system 3.5.0.2
ibm/general_parallel_file_system 3.5.0.3
ibm/general_parallel_file_system 3.5.0.4
ibm/general_parallel_file_system 3.5.0.5
ibm/general_parallel_file_system 3.5.0.6
ibm/general_parallel_file_system 3.5.0.7
ibm/general_parallel_file_system 3.5.0.8
ibm/general_parallel_file_system 3.5.0.9
... and 40 more
Published Nov 25, 2016
Tracked Since Feb 18, 2026