Bug 1632974 (CVE-2018-14652)

Summary: CVE-2018-14652 glusterfs: Buffer overflow in "features/locks" translator allows for denial of service
Product: [Other] Security Response Reporter: Sam Fowler <sfowler>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abhgupta, anoopcs, atumball, bmcclain, dbaker, dblechte, dfediuck, eedri, humble.devassy, jokerman, jonathansteffan, kkeithle, matthias, mgoldboi, michal.skrivanek, ndevos, public, ramkrsna, ravishankar, rhs-bugs, sankarshan, sbonazzo, security-response-team, sfowler, sherold, sisharma, ssaha, sthangav, trankin, vbellur
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20181031:0800,reported=20180926,source=researcher,cvss3=6.5/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H,cwe=CWE-120,fedora-all/glusterfs=affected,openshift-online-3/glusterfs=notaffected,rhel-6/glusterfs=notaffected,rhel-7/glusterfs=notaffected,rhev-m-4/glusterfs=affected,rhes-3/glusterfs=affected,rhel-8/glusterfs=notaffected
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A buffer overflow was found in strncpy of the pl_getxattr() function. An authenticated attacker could remotely overflow the buffer by sending a buffer of larger length than the size of the key resulting in remote denial of service.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-10 10:38:46 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1616829, 1634669, 1644579, 1644761, 1645363, 1645373    
Bug Blocks: 1632976, 1644080    

Description Sam Fowler 2018-09-26 00:48:53 UTC
The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the "features/index" translator via the code handling the "GF_XATTR_CLRLK_CMD" xattr in the "pl_getxattr" function. A remote authenticated attacker could exploit this on a mounted volume to cause a denial of service.

Comment 1 Sam Fowler 2018-09-26 00:49:02 UTC
Acknowledgments:

Name: Michael Hanselmann (hansmi.ch)

Comment 5 Doran Moppert 2018-10-30 00:21:52 UTC
Statement:

This issue did not affect Red Hat Enterprise Linux 6 and 7 as the flaw is present in glusterfs-server, which is not shipped there.

This flaw affects glusterfs versions included in Red Hat Virtualization 4 Hypervisor. However, in recommended configurations, the vulnerability is only exposed to hypervisor administrators and can not be exploited from virtual machines or other hosts on the network.

Comment 6 Siddharth Sharma 2018-10-31 08:12:06 UTC
Created glusterfs tracking bugs for this issue:

Affects: fedora-all [bug 1644579]

Comment 7 errata-xmlrpc 2018-10-31 08:43:16 UTC
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.4 for RHEL 6
  Native Client for RHEL 6 for Red Hat Storage

Via RHSA-2018:3431 https://access.redhat.com/errata/RHSA-2018:3431

Comment 8 errata-xmlrpc 2018-10-31 08:44:06 UTC
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.4 for RHEL 7
  Native Client for RHEL 7 for Red Hat Storage

Via RHSA-2018:3432 https://access.redhat.com/errata/RHSA-2018:3432

Comment 9 Siddharth Sharma 2018-11-02 04:53:00 UTC
upstream fix:

https://review.gluster.org/#/c/glusterfs/+/21535/

Comment 10 errata-xmlrpc 2018-11-05 14:58:19 UTC
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2018:3470 https://access.redhat.com/errata/RHSA-2018:3470