CVE-2016-9867
HighSummary
An issue was discovered in EMC ScaleIO versions before 2.0.1.1, allowing a low-privileged local attacker to modify kernel memory in the SCINI driver. This may lead to code execution and privilege escalation to root on ScaleIO Data Client (SDC) servers.
Risk Assessment
An attacker could gain full system privileges, posing a serious threat to the integrity and confidentiality of data within the organization.
Recommendation
It is recommended to upgrade to EMC ScaleIO version 2.0.1.1 or later to mitigate this vulnerability.
Other vulnerabilities in EMC ScaleIO
See all- CVE-2017-8019High
An issue was discovered in EMC ScaleIO 2.0.1.x related to message parsers (MDM, SDS, and LIA) that could allow an unauthenticated remote attacker to send specially crafted packets. This could lead to stopping ScaleIO services and causing a denial of service situation.
- CVE-2017-8001High
An issue was discovered in EMC ScaleIO 2.0.1.x where one of the support scripts saves the credentials of the MDM user in clear text in temporary log files. These files may be read by an unprivileged user with access to the server where the script was executed.
- CVE-2017-8020Critical
A buffer overflow vulnerability was discovered in EMC ScaleIO 2.0.1.x in the SDBG service, which may allow a remote unauthenticated attacker to execute arbitrary commands with root privileges on an affected server.
Original NVD description (English source)
An issue was discovered in EMC ScaleIO versions before 2.0.1.1. A low-privileged local attacker may be able to modify the kernel memory in the SCINI driver and may achieve code execution to escalate privileges to root on ScaleIO Data Client (SDC) servers.