CVE-2018-1088: High severity red hat gluster storage vulnerability

A privilege escalation flaw was found in gluster snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink.

As reported:

When certain options are enabled in Gluster, it creates a volume called glustersharedstorage. This volume is mounted on each server in the cluster and used to share state. The volume is not intended to be mounted by storage clients as it does not contain any data that is intended to be user accessi= ble. When snapshot scheduling is enabled in Gluster, this glustersharedstorage volume is used to coordinate the snapshots. Part of that is sharing the cron job that is used to trigger scheduled snaps. The crontab file exposed in the shared volume is symlinked into each server's /etc/cron.d directory. By default, the sharedstorage volume can be mounted by any client that has access to the cluster to mount data volumes. Further, since Gluster relies = on client-reported uids, the sharedstorage volume can be written from any of these clients, permitting cron entries to be added to the system crontab directory such that they will be executed by each server as root (or any ot= her uid).

— Red Hat