CVE-2018-10923: Input Validation
It was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs server node. An authenticated attacker could use this to create an arbitrary device and read data from any device attached to the glusterfs server node.
Other sources
The Gluster file system implements a series of file system operations in the form of remote procedure calls (RPC). They are transported over the wire using TCP, optionally protected by SSL/TLS.
The "mknod" call, derived from mknod(2), can create files pointing to devices ("device special file"). Such device files can be opened on the server using normal I/O operations. As a consequence it's possible to read arbitrary devices.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-10923?
CVE-2018-10923 is a vulnerability that allows an authenticated attacker to create arbitrary devices and read data from any device attached to the glusterfs server node.
Who is affected by CVE-2018-10923?
Users of GlusterFS versions 3.12.0 to 3.12.14 and 4.1.0 to 4.1.8, Red Hat Virtualization Host 4.0, Debian Debian Linux 8.0 and 9.0, Red Hat Enterprise Linux Server 6.0 and 7.0, and openSUSE Leap 15.1 are affected by CVE-2018-10923.
What is the severity of CVE-2018-10923?
CVE-2018-10923 has a severity rating of 8.1 (high).
How can an attacker exploit CVE-2018-10923?
An attacker can exploit CVE-2018-10923 by using the 'mknod' call derived from mknod(2) to create files pointing to devices on a glusterfs server node.
How can I fix CVE-2018-10923?
To fix CVE-2018-10923, users should update their GlusterFS installation to versions 3.12.14 or 4.1.4, as recommended by Red Hat. For other affected software, users should follow the remediation steps provided by the respective vendors.