CVE-2018-14660: Medium severity centos glusterfs vulnerability
A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GFMETALOCKKEY xattr. A remote, authenticated attacker could use this flaw to create multiple locks for single inode by using setxattr repetitively resulting in memory exhaustion of glusterfs server node.
Other sources
The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the "GFMETALOCKKEY" xattr. A remote, authenticated attacker could exploit this by mounting a Gluster volume and repeatedly calling "setxattr(2)" to trigger an out-of-memory error and resultant denial of service.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-14660?
CVE-2018-14660 is a vulnerability found in glusterfs server through versions 4.1.4 and 3.1.2.
What is the severity of CVE-2018-14660?
The severity of CVE-2018-14660 is medium with a severity value of 6.5.
How does CVE-2018-14660 affect Gluster GlusterFS?
CVE-2018-14660 affects Gluster GlusterFS versions 3.1.0 to 3.1.2 and 4.1.0 to 4.1.4.
How does CVE-2018-14660 affect Redhat Virtualization Host?
CVE-2018-14660 affects Redhat Virtualization Host version 4.0.
How does CVE-2018-14660 affect Redhat Enterprise Linux Server?
CVE-2018-14660 affects Redhat Enterprise Linux Server versions 6.0 and 7.0.