As reported: When certain options are enabled in Gluster, it creates a volume called gluster_shared_storage. This volume is mounted on each server in the cluster and used to share state. The volume is not intended to be mounted by storage clients as it does not contain any data that is intended to be user accessi= ble. When snapshot scheduling is enabled in Gluster, this gluster_shared_storage volume is used to coordinate the snapshots. Part of that is sharing the cron job that is used to trigger scheduled snaps. The crontab file exposed in the shared volume is symlinked into each server's /etc/cron.d directory. By default, the shared_storage volume can be mounted by any client that has access to the cluster to mount data volumes. Further, since Gluster relies = on client-reported uids, the shared_storage volume can be written from any of these clients, permitting cron entries to be added to the system crontab directory such that they will be executed by each server as root (or any ot= her uid).
Acknowledgments: Name: John Strunk (Red Hat)
Mitigation: To limit exposure of gluster server nodes : 1. gluster server should be on LAN and not reachable from public networks. 2. Use gluster auth.allow and auth.reject. 3. Use TLS certificates between gluster server nodes and clients. Caveat: This would only mitigate attacks from unauthorized malicious clients. gluster clients allowed by auth.allow or having signed TLS client certificates would still be able to trigger this attack.
Created glusterfs tracking bugs for this issue: Affects: fedora-all [bug 1568832]
This issue has been addressed in the following products: Red Hat Gluster Storage 3.3 for RHEL 6 Native Client for RHEL 6 for Red Hat Storage Via RHSA-2018:1137 https://access.redhat.com/errata/RHSA-2018:1137
This issue has been addressed in the following products: Red Hat Gluster Storage 3.3 for RHEL 7 Native Client for RHEL 7 for Red Hat Storage Via RHSA-2018:1136 https://access.redhat.com/errata/RHSA-2018:1136
External References: https://access.redhat.com/articles/3414511
upstream fixes: https://review.gluster.org/#/c/19899/ https://review.gluster.org/#/c/19898/
Statement: This vulnerability affects gluster servers that have, or have previously had, Gluster volume snapshot scheduling enabled from the CLI. Red Hat Enterprise Virtualization supports volume snapshot scheduling from the Web UI, which uses a distinct mechanism that is not subject to this vulnerability. VM snapshots are not impacted by this flaw. For more information, please see the Vulnerability Article linked under External References. This issue did not affect the versions of glusterfs as shipped with Red Hat Enterprise Linux 6, and 7 because only gluster client is shipped in these products. CVE-2018-1088 affects glusterfs-server package as shipped with Red Hat Gluster Storage 3.
This issue has been addressed in the following products: Red Hat Virtualization 4 for RHEL-7 Via RHSA-2018:1275 https://access.redhat.com/errata/RHSA-2018:1275
This issue has been addressed in the following products: Red Hat Virtualization 4 for RHEL-7 Via RHSA-2018:1524 https://access.redhat.com/errata/RHSA-2018:1524