Out-of-bounds read in GlusterFS - CVE-2023-26253

Vulnerability identifier: #VU74337

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-26253

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the notify() function in xlators/mount/fuse/src/fuse-bridge.c. A remote local user can trigger an out-of-bounds read error and perform a denial of service (DoS) attack.

GlusterFS
Ubuntu
openEuler
Fedora
glusterfs-server (Ubuntu package)
glusterfs-common (Ubuntu package)
glusterfs-client (Ubuntu package)
glusterfs-resource-agents
python3-gluster
glusterfs-debugsource
glusterfs-help
glusterfs-devel
glusterfs-debuginfo
glusterfs
VMware Tanzu Operations Manager

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

glusterfs-server (Ubuntu package) - addressed in versions Ubuntu Pro, 10.1-1ubuntu0.1, 10.2-1ubuntu0.1, 10.3-4ubuntu0.1
glusterfs-common (Ubuntu package) - addressed in versions Ubuntu Pro, 10.1-1ubuntu0.1, 10.2-1ubuntu0.1, 10.3-4ubuntu0.1
glusterfs-client (Ubuntu package) - addressed in versions Ubuntu Pro, 10.1-1ubuntu0.1, 10.2-1ubuntu0.1, 10.3-4ubuntu0.1
VMware Tanzu Operations Manager - update to 3.0.11
glusterfs-resource-agents - update to 7.0-10
python3-gluster - update to 7.0-10
glusterfs-debugsource - update to 7.0-10
glusterfs-help - update to 7.0-10
glusterfs-devel - update to 7.0-10
glusterfs-debuginfo - update to 7.0-10
glusterfs - update to 7.0-10
glusterfs - update to 10.4-1.fc37

• https://github.com/gluster/glusterfs/issues/3954

• Ubuntu update for glusterfs
• Multiple vulnerabilities in GlusterFS
• Ubuntu update for glusterfs
• VMware Tanzu Operations Manager update for GlusterFS
• Fedora 37 update for glusterfs
• openEuler update for glusterfs