Privilege escalation in GlusterFS - CVE-2018-10841
Published: July 16, 2018 / Updated: July 16, 2018
Vulnerability identifier: #VU13886
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-10841
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to gain elevated privileges on the target system.
The vulnerability exists due to boundary error when XXXXX. A remote authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes.
Affected software
GlusterFS
Red Hat Gluster Storage Server for On-premise
Red Hat Virtualization
Red Hat Virtualization Host
Red Hat Enterprise Linux Server
Fedora
glusterfs
Red Hat Gluster Storage Server for On-premise
Red Hat Virtualization
Red Hat Virtualization Host
Red Hat Enterprise Linux Server
Fedora
glusterfs
How to mitigate CVE-2018-10841
Install update from vendor's website.
glusterfs - update to 4.1.1-1.fc28