Bug 1607617 (CVE-2018-10914)

Summary:	CVE-2018-10914 glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abhgupta, amukherj, anoopcs, atumball, bmcclain, dbaker, dblechte, dfediuck, eedri, humble.devassy, jokerman, jonathansteffan, kkeithle, matthias, mgoldboi, michal.skrivanek, ndevos, public, ramkrsna, rhs-bugs, sankarshan, sbonazzo, security-response-team, sfowler, sherold, sisharma, ssaha, sthangav, trankin, vbellur
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	glusterfs-3.12.14, glusterfs-4.1.4	Doc Type:	If docs needed, set a value
Doc Text:	It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash which will result in a remote denial of service. If gluster multiplexing is enabled this will result in a crash of multiple bricks and gluster volumes.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:34:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1608366, 1610122, 1616829, 1625075, 1625077
Bug Blocks:	1607620

Description Laura Pardo 2018-07-23 20:22:33 UTC

A flaw was found in GlusterFS. A NULL pointer dereference vulnerability due to an improper implementation of the posix_get_file_contents function. An attacker could exploit this to perform a Denial of Service attack.

Comment 1 Laura Pardo 2018-07-24 16:45:13 UTC

Acknowledgments:

Name: Michael Hanselmann (hansmi.ch)

Comment 8 errata-xmlrpc 2018-09-04 06:24:46 UTC

This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.4 for RHEL 7
  Native Client for RHEL 7 for Red Hat Storage

Via RHSA-2018:2607 https://access.redhat.com/errata/RHSA-2018:2607

Comment 9 errata-xmlrpc 2018-09-04 06:25:55 UTC

This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.4 for RHEL 6
  Native Client for RHEL 6 for Red Hat Storage

Via RHSA-2018:2608 https://access.redhat.com/errata/RHSA-2018:2608

Comment 10 Siddharth Sharma 2018-09-04 14:30:55 UTC

upstream fix:

https://review.gluster.org/21071

Comment 11 Siddharth Sharma 2018-09-04 14:31:19 UTC

Mitigation:

SELinux mitigates this issue on Red Hat Gluster Storage 3. SELinux should be in enforcing mode only as permissive mode does not block attacks.

Comment 13 Doran Moppert 2018-09-06 05:04:43 UTC

Statement:

This issue did not affect Red Hat Enterprise Linux 6 and 7 as the flaw is present in glusterfs-server, which is not shipped there.

This flaw affects glusterfs versions included in Red Hat Virtualization 4 Hypervisor. However, in recommended configurations, the vulnerability is only exposed to hypervisor administrators and can not be exploited from virtual machines or other hosts on the network.

Comment 14 errata-xmlrpc 2018-11-05 14:56:50 UTC

This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2018:3470 https://access.redhat.com/errata/RHSA-2018:3470