Lustre is a parallel file system widely deployed in high-performance computing clusters and large-scale storage environments, where its distributed architecture and kernel integration create a substantial attack surface. The vendor's vulnerability profile recurs through memory-safety and input-validation weaknesses—out-of-bounds writes and reads, buffer overflows, and improper input handling—that are characteristic of systems-level code operating in kernel and user-space contexts with tight performance constraints. Defenders should prioritize patches for this vendor, particularly in environments where HPC clusters expose Lustre clients or servers to untrusted networks; current severity and exploitation activity are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Lustre over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-20427CRITICAL In the Lustre file system before 2.12.3, the ptlrpc module has a buffer overflow and panic, and possibly remote code execution, due to the lack of validation for specific fields of | Jan 27, 2020 | 9.8 | 30 | NO | NO |
CVE-2019-20424HIGH In the Lustre file system before 2.12.3, mdt_object_remote in the mdt module has a NULL pointer dereference and panic due to the lack of validation for specific fields of packets s | Jan 27, 2020 | 7.5 | 25 | NO | NO |
CVE-2019-20432HIGH In the Lustre file system before 2.12.3, the mdt module has an out-of-bounds access and panic due to the lack of validation for specific fields of packets sent by a client. mdt_fil | Jan 27, 2020 | 7.5 | 24 | NO | NO |
CVE-2019-20431HIGH In the Lustre file system before 2.12.3, the ptlrpc module has an osd_map_remote_to_local out-of-bounds access and panic due to the lack of validation for specific fields of packet | Jan 27, 2020 | 7.5 | 24 | NO | NO |
CVE-2019-20430HIGH In the Lustre file system before 2.12.3, the mdt module has an LBUG panic (via a large MDT Body eadatasize field) due to the lack of validation for specific fields of packets sent | Jan 27, 2020 | 7.5 | 24 | NO | NO |
CVE-2019-20429HIGH In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds read and panic (via a modified lm_bufcount field) due to the lack of validation for specific fields | Jan 27, 2020 | 7.5 | 24 | NO | NO |
CVE-2019-20428HIGH In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds read and panic due to the lack of validation for specific fields of packets sent by a client. The ld | Jan 27, 2020 | 7.5 | 24 | NO | NO |
CVE-2019-20426HIGH In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds access and panic due to the lack of validation for specific fields of packets sent by a client. In t | Jan 27, 2020 | 7.5 | 24 | NO | NO |
CVE-2019-20425HIGH In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds access and panic due to the lack of validation for specific fields of packets sent by a client. In t | Jan 27, 2020 | 7.5 | 24 | NO | NO |
CVE-2019-20423HIGH In the Lustre file system before 2.12.3, the ptlrpc module has a buffer overflow and panic due to the lack of validation for specific fields of packets sent by a client. The functi | Jan 27, 2020 | 7.5 | 24 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Lustre.
Media articles that mention a CVE ID that affects a product developed by Lustre — matched by CVE ID, not by vendor name.