Bug 1607617 (CVE-2018-10914)

Summary: CVE-2018-10914 glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c
Product: [Other] Security Response Reporter: Laura Pardo <lpardo>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abhgupta, amukherj, anoopcs, atumball, bmcclain, dbaker, dblechte, dfediuck, eedri, humble.devassy, jokerman, jonathansteffan, kkeithle, matthias, mgoldboi, michal.skrivanek, ndevos, public, ramkrsna, rhs-bugs, sankarshan, sbonazzo, security-response-team, sfowler, sherold, sisharma, ssaha, sthangav, trankin, vbellur
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: glusterfs-3.12.14, glusterfs-4.1.4 Doc Type: If docs needed, set a value
Doc Text:
It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash which will result in a remote denial of service. If gluster multiplexing is enabled this will result in a crash of multiple bricks and gluster volumes.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-10 10:34:02 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1608366, 1610122, 1616829, 1625075, 1625077    
Bug Blocks: 1607620    

Description Laura Pardo 2018-07-23 20:22:33 UTC
A flaw was found in GlusterFS. A NULL pointer dereference vulnerability due to an improper implementation of the posix_get_file_contents function. An attacker could exploit this to perform a Denial of Service attack.

Comment 1 Laura Pardo 2018-07-24 16:45:13 UTC

Name: Michael Hanselmann (hansmi.ch)

Comment 8 errata-xmlrpc 2018-09-04 06:24:46 UTC
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.4 for RHEL 7
  Native Client for RHEL 7 for Red Hat Storage

Via RHSA-2018:2607 https://access.redhat.com/errata/RHSA-2018:2607

Comment 9 errata-xmlrpc 2018-09-04 06:25:55 UTC
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.4 for RHEL 6
  Native Client for RHEL 6 for Red Hat Storage

Via RHSA-2018:2608 https://access.redhat.com/errata/RHSA-2018:2608

Comment 10 Siddharth Sharma 2018-09-04 14:30:55 UTC
upstream fix:


Comment 11 Siddharth Sharma 2018-09-04 14:31:19 UTC

SELinux mitigates this issue on Red Hat Gluster Storage 3. SELinux should be in enforcing mode only as permissive mode does not block attacks.

Comment 13 Doran Moppert 2018-09-06 05:04:43 UTC

This issue did not affect Red Hat Enterprise Linux 6 and 7 as the flaw is present in glusterfs-server, which is not shipped there.

This flaw affects glusterfs versions included in Red Hat Virtualization 4 Hypervisor. However, in recommended configurations, the vulnerability is only exposed to hypervisor administrators and can not be exploited from virtual machines or other hosts on the network.

Comment 14 errata-xmlrpc 2018-11-05 14:56:50 UTC
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2018:3470 https://access.redhat.com/errata/RHSA-2018:3470