CVE-2023-51786

Executive Summary

CVE-2023-51786 is an Incorrect Access Control vulnerability in the Lustre parallel distributed file system, affecting versions 2.13.x, 2.14.x, and 2.15.x prior to 2.15.4. This flaw allows an unauthenticated or low-privileged attacker to escalate privileges and obtain sensitive information by bypassing intended access controls. The vulnerability resides in the Lustre kernel module’s handling of metadata operations, potentially exposing file data and system credentials to unauthorized users. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation activity. However, given the critical nature of Lustre in high-performance computing (HPC) environments, immediate patching is recommended.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official CVSS vector assigned)
• Attack Vector (AV): Likely Network (AV:N) due to Lustre’s network-facing architecture.
• Attack Complexity (AC): Low (AC:L) – no special conditions required.
• Privileges Required (PR): Low (PR:L) – attacker needs minimal access to the filesystem.
• User Interaction (UI): None (UI:N) – no user action needed.
• Scope (S): Unchanged (S:U) – vulnerability affects only the Lustre component.
• Confidentiality (C): High (C:H) – sensitive data exposure.
• Integrity (I): High (I:H) – potential data modification.
• Availability (A): Low (A:L) – possible denial of service.
• Threat Level: High – due to potential privilege escalation and data leakage in HPC environments.

Deep Dive & Mechanics

The vulnerability stems from improper validation of access control checks in the Lustre metadata server (MDS) when processing client requests. Specifically, the mdt_attr_get() function fails to enforce correct permissions for certain metadata operations, allowing a client with low privileges to read or modify file attributes (e.g., ownership, permissions, ACLs) that should be restricted. This can lead to:

• Privilege Escalation: A user can change file ownership or permissions to gain unauthorized access to other users’ data.
• Information Disclosure: Sensitive metadata (e.g., file sizes, timestamps, extended attributes) can be leaked.
• Potential Lateral Movement: In HPC clusters, an attacker could pivot to other nodes by exploiting shared Lustre mounts.

The root cause is a missing or incorrect check in the mdt_attr_get() function within the Lustre kernel module (lustre/mdt/mdt_handler.c). The function does not verify that the requesting client has the necessary CAP_SYS_ADMIN or DAC_OVERRIDE capabilities for operations like LUSTRE_OPC_MDT_GETATTR on protected files.

Vulnerable vs. Patched Code

Vulnerable Code (Lustre < 2.15.4):

// lustre/mdt/mdt_handler.c
int mdt_attr_get(struct mdt_thread_info *info, struct lu_fid *fid,
                 struct md_attr *ma)
{
    // Missing access control check
    // Directly proceeds to fetch attributes
    return mdt_attr_get_internal(info, fid, ma);
}

Patched Code (Lustre >= 2.15.4):

// lustre/mdt/mdt_handler.c
int mdt_attr_get(struct mdt_thread_info *info, struct lu_fid *fid,
                 struct md_attr *ma)
{
    struct mdt_object *obj;
    int rc;

    obj = mdt_object_find(info->mti_env, info->mti_mdt, fid);
    if (IS_ERR(obj))
        return PTR_ERR(obj);

    // Added access control check
    rc = mdt_check_attr_permission(info, obj, MAY_READ);
    if (rc) {
        mdt_object_put(info->mti_env, obj);
        return rc;
    }

    rc = mdt_attr_get_internal(info, fid, ma);
    mdt_object_put(info->mti_env, obj);
    return rc;
}

The patch introduces a call to mdt_check_attr_permission() which verifies that the client has read permission on the object before returning attributes.

Exploitation & Lab Setup

Red Team (Exploitation)

No public exploit code is available. However, a theoretical exploitation scenario involves:

1. Reconnaissance: Identify Lustre MDS endpoints (default port 988).
2. Low-Privilege Access: Obtain a low-privileged account on a Lustre client.
3. Exploit: Send crafted RPC requests to the MDS with LUSTRE_OPC_MDT_GETATTR for a target file owned by root or another user.
4. Escalate: Modify file attributes (e.g., change ownership to self) to gain full access.

Lab Setup:

• Deploy a Lustre filesystem with version 2.15.3.
• Create a test user with minimal privileges.
• Use a custom Python script to send malformed RPCs (requires lustre-client and python3-lustre).

Example (Conceptual):

import socket
import struct

# Craft a malicious RPC to read attributes of /etc/shadow
rpc = b"\x00" * 100  # Simplified; actual RPC is complex
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect(("target-mds", 988))
sock.send(rpc)
response = sock.recv(4096)
print(response)
sock.close()

Blue Team (Detection & Defense)

• Monitor MDS Logs: Look for repeated mdt_attr_get calls from unexpected clients.
• Audit Permissions: Regularly check for unauthorized changes to file ownership or ACLs.
• Network Segmentation: Restrict access to Lustre ports (988, 1010-1023) to trusted subnets.
• Harden Clients: Apply least-privilege principles to all Lustre client accounts.

Indicators of Compromise (IOCs)

• Network: Unusual RPCs to port 988 with LUSTRE_OPC_MDT_GETATTR opcode (0x2000D).
• File System: Unexpected changes to file ownership or permissions on Lustre mounts.
• Logs: MDS logs showing mdt_attr_get failures or permission denied errors for privileged files.
• Processes: Unknown processes running with elevated privileges on Lustre clients.

Detection Engineering

YARA Rule

rule CVE_2023_51786_Lustre_Exploit {
    meta:
        description = "Detects potential exploitation of CVE-2023-51786 via crafted RPCs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-51786"
    strings:
        $rpc_opcode = { 00 0D 20 00 }  // LUSTRE_OPC_MDT_GETATTR in little-endian
        $target_file = "shadow" nocase
    condition:
        $rpc_opcode and $target_file
}

Sigma Rule

title: Suspicious Lustre MDS Attribute Request
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects repeated mdt_attr_get requests to sensitive files
author: Valters IT
logsource:
    product: linux
    service: lustre
detection:
    selection:
        EventID: 1001  # Example Lustre audit event
        Operation: "mdt_attr_get"
        FileName: 
            - "/etc/shadow"
            - "/etc/sudoers"
            - "/root/*"
    condition: selection
falsepositives:
    - Legitimate administrative tasks
level: high

Suricata Rule

alert tcp any any -> any 988 (msg:"CVE-2023-51786 - Potential Lustre MDS Exploit"; flow:to_server; content:"|00 0D 20 00|"; depth:4; offset:8; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade all Lustre servers and clients to version 2.15.4 or later.
2. Workaround: If patching is not possible, restrict network access to Lustre MDS ports (988, 1010-1023) using firewall rules.
3. Access Control: Implement strict RBAC on Lustre clients; disable unnecessary user accounts.
4. Monitoring: Enable Lustre audit logging and monitor for anomalous mdt_attr_get operations.
5. Backup: Ensure regular backups of critical data stored on Lustre filesystems.

Valters IT – Securing your digital infrastructure with precision.