REDHAT-BUG-1633431: Buffer Overflow
The Gluster file system through versions 4.1.4 and 3.12 is vulnerable to a heap-based buffer overflow in the "servergetspec" function via the "gfgetspecreq" RPC message. A remote authenticated attacker could exploit this to cause a denial of service or other potential unspecified impact.
Patching this issue also requires fixing the "buildvolfilepath" function to prevent arbitrary file reads via crafted filenames.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1633431?
The severity of REDHAT-BUG-1633431 is critical due to the potential for denial of service caused by a heap-based buffer overflow.
How do I fix REDHAT-BUG-1633431?
To fix REDHAT-BUG-1633431, upgrade to a patched version of the Gluster file system that addresses the heap-based buffer overflow vulnerability.
What versions are affected by REDHAT-BUG-1633431?
The affected versions for REDHAT-BUG-1633431 are Gluster file system versions between 3.12 and 4.1.4.
Can REDHAT-BUG-1633431 be exploited remotely?
Yes, REDHAT-BUG-1633431 can be exploited remotely by an authenticated attacker, potentially leading to denial of service.
What component of the Gluster file system is vulnerable in REDHAT-BUG-1633431?
The vulnerable component in REDHAT-BUG-1633431 is the "__server_getspec" function, which processes the "gf_getspec_req" RPC message.