CVE-2018-14660
Published: 1 November 2018
A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_LOCK_KEY xattr. A remote, authenticated attacker could use this flaw to create multiple locks for single inode by using setxattr repetitively resulting in memory exhaustion of glusterfs server node.
From the Ubuntu Security Team
It was discovered that GlusterFS incorrectly handled certain inputs. A remote authenticated attacker could possibly use this is issue to cause a denial of service.
Priority
Status
Package | Release | Status |
---|---|---|
glusterfs Launchpad, Ubuntu, Debian |
jammy |
Not vulnerable
(4.1.4-1)
|
bionic |
Released
(3.13.2-1ubuntu1+esm1)
Available with Ubuntu Pro |
|
cosmic |
Ignored
(end of life)
|
|
disco |
Not vulnerable
(4.1.4-1)
|
|
eoan |
Not vulnerable
(4.1.4-1)
|
|
focal |
Not vulnerable
(4.1.4-1)
|
|
groovy |
Not vulnerable
(4.1.4-1)
|
|
hirsute |
Not vulnerable
(4.1.4-1)
|
|
impish |
Not vulnerable
(4.1.4-1)
|
|
kinetic |
Not vulnerable
(4.1.4-1)
|
|
lunar |
Not vulnerable
(4.1.4-1)
|
|
trusty |
Not vulnerable
(code not present)
|
|
upstream |
Needs triage
|
|
xenial |
Not vulnerable
(code not present)
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 6.5 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | Low |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | None |
Availability impact | High |
Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |