It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash which will result in a remote denial of service. If gluster multiplexing is enabled this will result in a crash of multiple bricks and gluster volumes.
The product dereferences a pointer that it expects to be valid but is NULL.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Glusterfs | Gluster | 3.12.0 (including) | 3.12.14 (excluding) |
| Glusterfs | Gluster | 4.1.0 (including) | 4.1.8 (excluding) |
| Native Client for RHEL 6 for Red Hat Storage | RedHat | glusterfs-0:3.12.2-18.el6 | * |
| Native Client for RHEL 7 for Red Hat Storage | RedHat | glusterfs-0:3.12.2-18.el7 | * |
| Red Hat Gluster Storage 3.4 for RHEL 6 | RedHat | glusterfs-0:3.12.2-18.el6rhs | * |
| Red Hat Gluster Storage 3.4 for RHEL 6 | RedHat | redhat-release-server-0:6Server-6.10.0.24.el6rhs | * |
| Red Hat Gluster Storage 3.4 for RHEL 6 | RedHat | redhat-storage-server-0:3.4.0.0-1.el6rhs | * |
| Red Hat Gluster Storage 3.4 for RHEL 7 | RedHat | glusterfs-0:3.12.2-18.el7rhgs | * |
| Red Hat Gluster Storage 3.4 for RHEL 7 | RedHat | redhat-release-server-0:7.5-11.el7rhgs | * |
| Red Hat Gluster Storage 3.4 for RHEL 7 | RedHat | redhat-storage-server-0:3.4.0.0-1.el7rhgs | * |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | RedHat | glusterfs-0:3.12.2-18.el7 | * |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | RedHat | imgbased-0:1.0.29-1.el7ev | * |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | RedHat | redhat-release-virtualization-host-0:4.2-7.3.el7 | * |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | RedHat | redhat-virtualization-host-0:4.2-20181026.0.el7_6 | * |
| Glusterfs | Ubuntu | bionic | * |
| Glusterfs | Ubuntu | cosmic | * |
| Glusterfs | Ubuntu | esm-apps/bionic | * |
| Glusterfs | Ubuntu | esm-apps/xenial | * |
| Glusterfs | Ubuntu | esm-infra-legacy/trusty | * |
| Glusterfs | Ubuntu | trusty | * |
| Glusterfs | Ubuntu | trusty/esm | * |
| Glusterfs | Ubuntu | xenial | * |