Vulnetix
Try Vulnetix Request Demo
CVE-2018-14659 PUBLISHED

The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GF_XATTR_IOSTATS_DUMP_KEY' xattr. A remote, authenticated attacker could exploit this by mounting a Gluster volume and repeatedly calling 'setxattr(2)' to trigger a state dump and create an arbitrary number of files in the server's runtime directory.

EPSS 2.14% · 84.1th percentile

Risk Scores

EPSS Score
2.14%
84.1th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:16.04:LTSglusterfs0, 3.7.6-1ubuntu1, 3.7.3-1ubuntu2
Ubuntu:Pro:18.04:LTSglusterfs3.13.2-1ubuntu1, 3.12.2-2, 3.12.3-1
Ubuntu:Pro:14.04:LTSglusterfs3.4.2-1ubuntu1, 3.4.1-2ubuntu1, 3.4.1-1ubuntu1

Timeline

References

Open in Interactive Console →