影響
Critical
詳細
デル・テクノロジーズでは、すべてのお客様に対して、CVSSベース スコアに加えて、特定のセキュリティの脆弱性に付随する潜在的な重要度に影響する可能性のある現状スコアや環境スコアも考慮することをお勧めしています。
影響を受ける製品と修復
Note: The table above may not be a comprehensive list of all affected supported versions and may be updated as more information becomes available.
Note: The table above may not be a comprehensive list of all affected supported versions and may be updated as more information becomes available.
回避策と緩和策
Implement the following workaround on the PowerFlex Presentation server OS:
Option 1:
- Download the zip file "log4j-2.17.1-presentation_server_mitigation.zip " from the PowerFlex support site: https://www.dell.com/support/home/en-us/product-support/product/scaleio/drivers.
Note: It requires login permissions to https://www.dell.com/support.
- SSH to the presentation server and log in with the relevant credentials, and copy the zip using SCP or WinSCP to the folder you are currently logged in to.
For RHEL or CentOS 6, 7, or 8, SLES15.x, and Ubuntu 18/20, use the below changes to mitigate this security vulnerability:
- For PowerFlex 3.6 or 3.5, run the following steps:
- Check the files are under the following location using: ls /opt/emc/scaleio/mgmt-server/lib/ |grep log4.
- Run the following commands to remove:
Commands:
rm /opt/emc/scaleio/mgmt-server/lib/log4j-*
unzip log4j-2.17.1-presentation_server_mitigation.zip -d /opt/emc/scaleio/mgmt-server/lib
Note: if you don’t have unzip on the OS you can use tar -xvf <zip file> or install unzip on the OS
chown mgmt-server /opt/emc/scaleio/mgmt-server/lib/log4j*
chgrp mgmt-server /opt/emc/scaleio/mgmt-server/lib/log4j*
After finishing configuration steps:
- If you are running on a system with SELinux enabled, run the following command:
Command:
restorecon -Fv /opt/emc/scaleio/mgmt-server/lib/log4j*
- For PowerFlex 3.6 with RHEL 7.x or 8.x, SLES, and Ubuntu, follow the below step:
- Use the following command to restart the mgmt-server service (for all OS versions above):
Command:
systemctl restart mgmt-server
- For PowerFlex 3.6 with RHEL 6.x, follow the below step:
- Use the following commands to restart the service:
Commands:
initctl stop mgmt-server
initctl start mgmt-server
- For PowerFlex 3.5 on RHEL 7.x or 8.x, follow the below steps:
- Use the following command to reload the daemon config files:
Command:
systemctl daemon-reload
- Use the following command to restart the mgmt-server service:
Command:
systemctl restart mgmt-server.service
This allows the parameter to be read in properly. If you restart the service without reloading the daemon config files, it uses what is in memory and you are not using the parameter change.
- For PowerFlex 3.5 on RHEL 6.x, follow the below step:
- Use the following commands to restart the service:
Commands:
initctl stop mgmt-server
initctl start mgmt-server
At this point, logging is still enabled, and the vulnerability is contained. The log4j files can also be moved or deleted on the presentation server as a different workaround, but this stops logging for the presentation server. All config changes are still logged with the MDM and the trace logs there.
Option 2:
- Remove Log4j files from the OS using the following steps:
Note: This option removes the presentation server logging capability, the MDM event logging continues to function and register Cluster events.
- Run command: rm -f /opt/emc/scaleio/mgmt-server/lib/log4j*
After finishing configuration steps:
- For PowerFlex 3.6 with RHEL 7.x or 8.x, follow the below step:
- Use the following command to restart the mgmt-server service (for all OS versions above):
Command:
systemctl restart mgmt-server
- For PowerFlex 3.6 with RHEL 6.x, follow the below step:
- Use the following commands to restart the service:
Commands:
initctl stop mgmt-server
initctl start mgmt-server
- For PowerFlex 3.5 on RHEL 7.x or 8.x, follow the below steps:
- Use the following command to reload the daemon config files:
Command:
systemctl daemon-reload
- Use the following command to restart the mgmt-server service:
Command:
systemctl restart mgmt-server.service
This allows the new jar to be reloaded. If you restart the service without reloading the daemon config files, it uses what is in memory and you are not using the change.
- For PowerFlex 3.5 on RHEL 6.x, follow the below step:
- Use the following commands to restart the service
Commands:
initctl stop mgmt-server
initctl start mgmt-server
At this point, logging is not enabled, and the vulnerability is contained.
変更履歴
| Revision | Date | Description |
| 1.0 | 2021-12-15 | Initial Release |
| 1.1 | 2021-12-22 | Update for addition of CVE-2021-45105 |
| 1.2 | 2022-01-04 | Added new ZIP with Log4j 2.17.1 remediation |
| 1.3 | 2022-01-06 | Added revised ZIP with Log4j 2.17.1 and unzip guidance |
| 2.0 | 2022-01-20 | Added Link to Update: Remediation made available for versions 3.6.0.3 and 3.5.1.5 |
| 2.1 | 2022-01-25 | Minor update to Workarounds and Mitigations section. |
関連情報
Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide
PowerFlex custom node, Product Security Information, VxFlex Ready Node, ScaleIO Ready Node-PowerEdge 13G