Bug 1636880 (CVE-2018-14661)

Summary: CVE-2018-14661 glusterfs: features/locks translator passes an user-controlled string to snprintf without a proper format string resulting in a denial of service
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abhgupta, anoopcs, atumball, bmcclain, dbaker, dblechte, dfediuck, eedri, humble.devassy, jokerman, jonathansteffan, kkeithle, matthias, mgoldboi, michal.skrivanek, ndevos, public, ramkrsna, rhs-bugs, sankarshan, sbonazzo, security-response-team, sheggodu, sherold, sisharma, ssaha, sthangav, trankin, vbellur
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20181031:0800,reported=20181006,source=researcher,cvss3=6.5/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H,cwe=CWE-20,fedora-all/glusterfs=affected,openshift-online-3/glusterfs=notaffected,rhel-6/glusterfs=notaffected,rhel-7/glusterfs=notaffected,rhel-8/glusterfs=notaffected,rhev-m-4/glusterfs=affected,rhes-3/glusterfs=affected
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
It was found that usage of snprintf function in feature/locks translator of glusterfs server was vulnerable to a format string attack. A remote, authenticated attacker could use this flaw to cause remote denial of service.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-10 10:39:27 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1616829, 1637084, 1644578, 1644763, 1647666, 1647668    
Bug Blocks: 1636883, 1644080    

Description Andrej Nemec 2018-10-08 07:55:05 UTC
A vulnerability was found in Gluster's features/locks translator An user-controlled string is given to snprintf without a proper format string. Sending a specially crafted string would result in a denial of service.

Comment 1 Andrej Nemec 2018-10-08 07:55:17 UTC
Acknowledgments:

Name: Michael Hanselmann (hansmi.ch)

Comment 4 Doran Moppert 2018-10-11 00:10:51 UTC
Statement:

This issue did not affect Red Hat Enterprise Linux 6 and 7 as the flaw is present in glusterfs-server, which is not shipped there.

This flaw affects glusterfs versions included in Red Hat Virtualization 4 Hypervisor. However, in recommended configurations, the vulnerability is only exposed to hypervisor administrators and can not be exploited from virtual machines or other hosts on the network.

Comment 5 Siddharth Sharma 2018-10-31 08:11:57 UTC
Created glusterfs tracking bugs for this issue:

Affects: fedora-all [bug 1644578]

Comment 6 errata-xmlrpc 2018-10-31 08:43:42 UTC
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.4 for RHEL 6
  Native Client for RHEL 6 for Red Hat Storage

Via RHSA-2018:3431 https://access.redhat.com/errata/RHSA-2018:3431

Comment 7 errata-xmlrpc 2018-10-31 08:44:50 UTC
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.4 for RHEL 7
  Native Client for RHEL 7 for Red Hat Storage

Via RHSA-2018:3432 https://access.redhat.com/errata/RHSA-2018:3432

Comment 8 Siddharth Sharma 2018-11-01 05:22:06 UTC
upstream fix:

https://review.gluster.org/#/c/glusterfs/+/21532/

Comment 9 errata-xmlrpc 2018-11-05 14:58:59 UTC
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2018:3470 https://access.redhat.com/errata/RHSA-2018:3470