CVE-2016-0392

Severity: high (CVSS 8.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-06-19 · updated 2026-06-17
Weakness: CWE-284

Description

IBM General Parallel File System (GPFS) in GPFS Storage Server 2.0.0 through 2.0.7 and Elastic Storage Server 2.5.x through 2.5.5, 3.x before 3.5.5, and 4.x before 4.0.3, as distributed in Spectrum Scale RAID, allows local users to gain privileges via a crafted parameter to a setuid program.

Affected products

IBM Elastic Storage Server: 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.5.4, 2.5.5 (+14)
IBM General Parallel File System Storage Server: 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5 (+2)

References

http://packetstormsecurity.com/files/137373/IBM-GPFS-Spectrum-Scale-Command-Injection.html
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1005875
http://www-01.ibm.com/support/docview.wss?uid=swg1IV84206
http://www.securityfocus.com/archive/1/538620/100/0/threaded
http://www.securityfocus.com/bid/91082
http://www.securitytracker.com/id/1036458
http://packetstormsecurity.com/files/137373/IBM-GPFS-Spectrum-Scale-Command-Injection.html
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1005875
http://www-01.ibm.com/support/docview.wss?uid=swg1IV84206
http://www.securityfocus.com/archive/1/538620/100/0/threaded
http://www.securityfocus.com/bid/91082
http://www.securitytracker.com/id/1036458

Get alerted when CVE-2016-0392 or the next vulnerability affects your stack