PT-2018-12649 · Red Hat+1 · Gluster+1

Michael Hanselmann + 1 · Published 2018-10-31 · Updated 2023-02-13 · CVE-2018-14659

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Gluster file system versions 3.1.2 through 4.1.4

Description The issue allows a remote, authenticated attacker to perform a denial of service attack by utilizing the GF XATTR IOSTATS DUMP KEY xattr. This can be exploited by mounting a Gluster volume and repeatedly calling setxattr(2) to trigger a state dump, resulting in the creation of an arbitrary number of files in the server's runtime directory.

Recommendations For versions 3.1.2 through 4.1.4, consider restricting access to the GF XATTR IOSTATS DUMP KEY xattr to prevent exploitation. As a temporary workaround, consider disabling the setxattr(2) function until a patch is available. Restrict access to the Gluster volume to minimize the risk of exploitation.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2018-14659

DLA-1565-1

DLA-2806-1

RHSA-2018:3431

RHSA-2018:3432

RHSA-2018:3470

USN-4770-1

Affected Products

Gluster

Ubuntu

References · 75

• https://ubuntu.com/security/CVE-2018-10924 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-14659 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10928 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10911 · Security Note
• https://security-tracker.debian.org/tracker/DLA-1565-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10923 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1088 · Security Note
• https://ubuntu.com/security/CVE-2018-10913 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14659 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10926 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10911 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10923 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14653 · Security Note
• https://ubuntu.com/security/CVE-2018-10914 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14659 · Vendor Advisory