CVE-2018-14660
Fixed in a distro release EPSS 3%CVSS 6.5
A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_LOCK_KEY xattr. A remote, authenticated attacker could use this flaw to create multiple locks for single inode by using setxattr repetitively resulting in memory exhaustion of glusterfs server node.
Products: glusterfs, redhat virtualization_host, redhat enterprise_linux_server, redhat virtualization, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | glusterfs | 5.1-1 |
| Debian 13 | glusterfs | 5.1-1 |
| Debian 14 | glusterfs | 5.1-1 |
| Debian 9 | glusterfs | 3.8.8-1+deb9u1 |
| Red Hat Enterprise Linux 7 | glusterfs | 0:3.12.2-25.el7 |
| Red Hat Enterprise Linux 7 | glusterfs-api | 0:3.12.2-25.el7 |
| Red Hat Enterprise Linux 7 | glusterfs-api-devel | 0:3.12.2-25.el7 |
| Red Hat Enterprise Linux 7 | glusterfs-cli | 0:3.12.2-25.el7 |
| Red Hat Enterprise Linux 7 | glusterfs-client-xlators | 0:3.12.2-25.el7 |
| Red Hat Enterprise Linux 7 | glusterfs-debuginfo | 0:3.12.2-25.el7 |
| Red Hat Enterprise Linux 7 | glusterfs-devel | 0:3.12.2-25.el7 |
| Red Hat Enterprise Linux 7 | glusterfs-fuse | 0:3.12.2-25.el7 |
| Red Hat Enterprise Linux 7 | glusterfs-libs | 0:3.12.2-25.el7 |
| Red Hat Enterprise Linux 7 | glusterfs-rdma | 0:3.12.2-25.el7 |
| Red Hat Enterprise Linux 7 | imgbased | 0:1.0.29-1.el7ev |
| Red Hat Enterprise Linux 7 | python-imgbased | 0:1.0.29-1.el7ev |
| Red Hat Enterprise Linux 7 | redhat-release-virtualization-host | 0:4.2-7.3.el7 |
| Red Hat Enterprise Linux 7 | redhat-virtualization-host | 0:4.2-20181026.0.el7_6 |
| Red Hat Enterprise Linux 7 | redhat-virtualization-host-image-update | 0:4.2-20181026.0.el7_6 |
| Red Hat Enterprise Linux 7 | redhat-virtualization-host-image-update-placeholder | 0:4.2-7.3.el7 |
| Red Hat storage 3.4 server el6 | glusterfs | 0:3.12.2-25.el6rhs |
| Red Hat storage 3.4 server el6 | glusterfs-api | 0:3.12.2-25.el6rhs |
| Red Hat storage 3.4 server el6 | glusterfs-api-devel | 0:3.12.2-25.el6rhs |
| Red Hat storage 3.4 server el6 | glusterfs-cli | 0:3.12.2-25.el6rhs |
| Red Hat storage 3.4 server el6 | glusterfs-client-xlators | 0:3.12.2-25.el6rhs |
| Red Hat storage 3.4 server el6 | glusterfs-debuginfo | 0:3.12.2-25.el6rhs |
| Red Hat storage 3.4 server el6 | glusterfs-devel | 0:3.12.2-25.el6rhs |
| Red Hat storage 3.4 server el6 | glusterfs-events | 0:3.12.2-25.el6rhs |
| Red Hat storage 3.4 server el6 | glusterfs-fuse | 0:3.12.2-25.el6rhs |
| Red Hat storage 3.4 server el6 | glusterfs-ganesha | 0:3.12.2-25.el6rhs |
| Red Hat storage 3.4 server el6 | glusterfs-geo-replication | 0:3.12.2-25.el6rhs |
| Red Hat storage 3.4 server el6 | glusterfs-libs | 0:3.12.2-25.el6rhs |
| Red Hat storage 3.4 server el6 | glusterfs-rdma | 0:3.12.2-25.el6rhs |
| Red Hat storage 3.4 server el6 | glusterfs-server | 0:3.12.2-25.el6rhs |
| Red Hat storage 3.4 server el6 | python2-gluster | 0:3.12.2-25.el6rhs |
| Red Hat storage 3.4 server el6 | redhat-storage-server | 0:3.4.1.0-1.el6rhs |
| Red Hat storage 3.4 server el7 | glusterfs | 0:3.12.2-25.el7rhgs |
| Red Hat storage 3.4 server el7 | glusterfs-api | 0:3.12.2-25.el7rhgs |
| Red Hat storage 3.4 server el7 | glusterfs-api-devel | 0:3.12.2-25.el7rhgs |
| Red Hat storage 3.4 server el7 | glusterfs-cli | 0:3.12.2-25.el7rhgs |
| Red Hat storage 3.4 server el7 | glusterfs-client-xlators | 0:3.12.2-25.el7rhgs |
| Red Hat storage 3.4 server el7 | glusterfs-debuginfo | 0:3.12.2-25.el7rhgs |
| Red Hat storage 3.4 server el7 | glusterfs-devel | 0:3.12.2-25.el7rhgs |
| Red Hat storage 3.4 server el7 | glusterfs-events | 0:3.12.2-25.el7rhgs |
| Red Hat storage 3.4 server el7 | glusterfs-fuse | 0:3.12.2-25.el7rhgs |
| Red Hat storage 3.4 server el7 | glusterfs-ganesha | 0:3.12.2-25.el7rhgs |
| Red Hat storage 3.4 server el7 | glusterfs-geo-replication | 0:3.12.2-25.el7rhgs |
| Red Hat storage 3.4 server el7 | glusterfs-libs | 0:3.12.2-25.el7rhgs |
| Red Hat storage 3.4 server el7 | glusterfs-rdma | 0:3.12.2-25.el7rhgs |
| Red Hat storage 3.4 server el7 | glusterfs-resource-agents | 0:3.12.2-25.el7rhgs |
| Red Hat storage 3.4 server el7 | glusterfs-server | 0:3.12.2-25.el7rhgs |
| Red Hat storage 3.4 server el7 | python2-gluster | 0:3.12.2-25.el7rhgs |
| Red Hat storage 3.4 server el7 | redhat-storage-server | 0:3.4.1.0-1.el7rhgs |
| Red Hat storage 3 client el6 | glusterfs | 0:3.12.2-25.el6 |
| Red Hat storage 3 client el6 | glusterfs-api | 0:3.12.2-25.el6 |
| Red Hat storage 3 client el6 | glusterfs-api-devel | 0:3.12.2-25.el6 |
| Red Hat storage 3 client el6 | glusterfs-cli | 0:3.12.2-25.el6 |
| Red Hat storage 3 client el6 | glusterfs-client-xlators | 0:3.12.2-25.el6 |
| Red Hat storage 3 client el6 | glusterfs-debuginfo | 0:3.12.2-25.el6 |
| Red Hat storage 3 client el6 | glusterfs-devel | 0:3.12.2-25.el6 |
| Red Hat storage 3 client el6 | glusterfs-fuse | 0:3.12.2-25.el6 |
| Red Hat storage 3 client el6 | glusterfs-libs | 0:3.12.2-25.el6 |
| Red Hat storage 3 client el6 | glusterfs-rdma | 0:3.12.2-25.el6 |
| Red Hat storage 3 client el6 | python2-gluster | 0:3.12.2-25.el6 |
| Red Hat storage 3 client el7 | glusterfs | 0:3.12.2-25.el7 |
| Red Hat storage 3 client el7 | glusterfs-api | 0:3.12.2-25.el7 |
| Red Hat storage 3 client el7 | glusterfs-api-devel | 0:3.12.2-25.el7 |
| Red Hat storage 3 client el7 | glusterfs-cli | 0:3.12.2-25.el7 |
| Red Hat storage 3 client el7 | glusterfs-client-xlators | 0:3.12.2-25.el7 |
| Red Hat storage 3 client el7 | glusterfs-debuginfo | 0:3.12.2-25.el7 |
| Red Hat storage 3 client el7 | glusterfs-devel | 0:3.12.2-25.el7 |
| Red Hat storage 3 client el7 | glusterfs-fuse | 0:3.12.2-25.el7 |
| Red Hat storage 3 client el7 | glusterfs-libs | 0:3.12.2-25.el7 |
| Red Hat storage 3 client el7 | glusterfs-rdma | 0:3.12.2-25.el7 |
| Red Hat storage 3 client el7 | python2-gluster | 0:3.12.2-25.el7 |
| Ubuntu Pro 14.04 LTS | glusterfs | 3.4.2-1ubuntu1+esm1 |
| Ubuntu Pro 16.04 LTS | glusterfs | 3.7.6-1ubuntu1+esm1 |
| Ubuntu Pro 18.04 LTS | glusterfs | 3.13.2-1ubuntu1+esm1 |