RHSA-2018:2607

RHSA-2018:2608

RHSA-2018:3470

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10913

[debian-lts-announce] 20180920 [SECURITY] [DLA 1510-1] glusterfs security update

https://review.gluster.org/#/c/glusterfs/+/21071/

GLSA-201904-06

According to the versions of the glusterfs packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in RPC request using gfs3_rename_req     in glusterfs server. An authenticated attacker could     use this flaw to write to a destination outside the     gluster volume.(CVE-2018-10930)

  - A flaw was found in RPC request using gfs2_create_req     in glusterfs server. An authenticated attacker could     use this flaw to create arbitrary files and execute     arbitrary code on glusterfs server     nodes.(CVE-2018-10929)

  - A flaw was found in RPC request using gfs3_symlink_req     in glusterfs server which allows symlink destinations     to point to file paths outside of the gluster volume.
    An authenticated attacker could use this flaw to create     arbitrary symlinks pointing anywhere on the server and     execute arbitrary code on glusterfs server     nodes.(CVE-2018-10928)

  - A flaw was found in RPC request using gfs3_lookup_req     in glusterfs server. An authenticated attacker could     use this flaw to leak information and execute remote     denial of service by crashing gluster brick     process.(CVE-2018-10927)

  - A flaw was found in RPC request using gfs3_mknod_req     supported by glusterfs server. An authenticated     attacker could use this flaw to write files to an     arbitrary location via path traversal and execute     arbitrary code on a glusterfs server     node.(CVE-2018-10926)

  - It was found that glusterfs server does not properly     sanitize file paths in the 'trusted.io-stats-dump'     extended attribute which is used by the     'debug/io-stats' translator. An attacker can use this     flaw to create files and execute arbitrary code. To     exploit this, the attacker would require sufficient     access to modify the extended attributes of files on a     gluster volume.(CVE-2018-10904)

  - It was found that glusterfs server is vulnerable to     mulitple stack based buffer overflows due to functions     in server-rpc-fopc.c allocating fixed size buffers     using 'alloca(3)'. An authenticated attacker could     exploit this by mounting a gluster volume and sending a     string longer that the fixed buffer size to cause crash     or potential code execution.(CVE-2018-10907)

  - An information disclosure vulnerability was discovered     in glusterfs server. An attacker could issue a xattr     request via glusterfs FUSE to determine the existence     of any file.(CVE-2018-10913)

  - It was found that an attacker could issue a xattr     request via glusterfs FUSE to cause gluster brick     process to crash which will result in a remote denial     of service. If gluster multiplexing is enabled this     will result in a crash of multiple bricks and gluster     volumes.(CVE-2018-10914)

  - It was found that the 'mknod' call derived from     mknod(2) can create files pointing to devices on a     glusterfs server node. An authenticated attacker could     use this to create an arbitrary device and read data     from any device attached to the glusterfs server     node.(CVE-2018-10923)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glusterfs packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in RPC request using gfs3_rename_req     in glusterfs server. An authenticated attacker could     use this flaw to write to a destination outside the     gluster volume.(CVE-2018-10930)

  - A flaw was found in RPC request using gfs2_create_req     in glusterfs server. An authenticated attacker could     use this flaw to create arbitrary files and execute     arbitrary code on glusterfs server     nodes.(CVE-2018-10929)

  - A flaw was found in RPC request using gfs3_symlink_req     in glusterfs server which allows symlink destinations     to point to file paths outside of the gluster volume.
    An authenticated attacker could use this flaw to create     arbitrary symlinks pointing anywhere on the server and     execute arbitrary code on glusterfs server     nodes.(CVE-2018-10928)

  - A flaw was found in RPC request using gfs3_lookup_req     in glusterfs server. An authenticated attacker could     use this flaw to leak information and execute remote     denial of service by crashing gluster brick     process.(CVE-2018-10927)

  - A flaw was found in RPC request using gfs3_mknod_req     supported by glusterfs server. An authenticated     attacker could use this flaw to write files to an     arbitrary location via path traversal and execute     arbitrary code on a glusterfs server     node.(CVE-2018-10926)

  - It was found that glusterfs server does not properly     sanitize file paths in the 'trusted.io-stats-dump'     extended attribute which is used by the     'debug/io-stats' translator. Attacker can use this flaw     to create files and execute arbitrary code. To exploit     this attacker would require sufficient access to modify     the extended attributes of files on a gluster     volume.(CVE-2018-10904)

  - It was found that glusterfs server is vulnerable to     multiple stack based buffer overflows due to functions     in server-rpc-fopc.c allocating fixed size buffers     using 'alloca(3)'. An authenticated attacker could     exploit this by mounting a gluster volume and sending a     string longer that the fixed buffer size to cause crash     or potential code execution.(CVE-2018-10907)

  - An information disclosure vulnerability was discovered     in glusterfs server. An attacker could issue a xattr     request via glusterfs FUSE to determine the existence     of any file.(CVE-2018-10913)

  - It was found that an attacker could issue a xattr     request via glusterfs FUSE to cause gluster brick     process to crash which will result in a remote denial     of service. If gluster multiplexing is enabled this     will result in a crash of multiple bricks and gluster     volumes.(CVE-2018-10914)

  - It was found that the 'mknod' call derived from     mknod(2) can create files pointing to devices on a     glusterfs server node. An authenticated attacker could     use this to create an arbitrary device and read data     from any device attached to the glusterfs server     node.(CVE-2018-10923)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glusterfs packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in RPC request using gfs2_create_req     in glusterfs server. An authenticated attacker could     use this flaw to create arbitrary files and execute     arbitrary code on glusterfs server     nodes.(CVE-2018-10929)

  - A flaw was found in RPC request using gfs3_lookup_req     in glusterfs server. An authenticated attacker could     use this flaw to leak information and execute remote     denial of service by crashing gluster brick     process.(CVE-2018-10927)

  - A flaw was found in RPC request using gfs3_mknod_req     supported by glusterfs server. An authenticated     attacker could use this flaw to write files to an     arbitrary location via path traversal and execute     arbitrary code on a glusterfs server     node.(CVE-2018-10926)

  - A flaw was found in RPC request using gfs3_rename_req     in glusterfs server. An authenticated attacker could     use this flaw to write to a destination outside the     gluster volume.(CVE-2018-10930)

  - A flaw was found in RPC request using gfs3_symlink_req     in glusterfs server which allows symlink destinations     to point to file paths outside of the gluster volume.
    An authenticated attacker could use this flaw to create     arbitrary symlinks pointing anywhere on the server and     execute arbitrary code on glusterfs server     nodes.(CVE-2018-10928)

  - It was found that glusterfs server does not properly     sanitize file paths in the 'trusted.io-stats-dump'     extended attribute which is used by the     'debug/io-stats' translator. Attacker can use this flaw     to create files and execute arbitrary code. To exploit     this attacker would require sufficient access to modify     the extended attributes of files on a gluster     volume.(CVE-2018-10904)

  - It was found that glusterfs server is vulnerable to     multiple stack based buffer overflows due to functions     in server-rpc-fopc.c allocating fixed size buffers     using 'alloca(3)'. An authenticated attacker could     exploit this by mounting a gluster volume and sending a     string longer that the fixed buffer size to cause crash     or potential code execution.(CVE-2018-10907)

  - An information disclosure vulnerability was discovered     in glusterfs server. An attacker could issue a xattr     request via glusterfs FUSE to determine the existence     of any file.(CVE-2018-10913)

  - It was found that an attacker could issue a xattr     request via glusterfs FUSE to cause gluster brick     process to crash which will result in a remote denial     of service. If gluster multiplexing is enabled this     will result in a crash of multiple bricks and gluster     volumes.(CVE-2018-10914)

  - It was found that the 'mknod' call derived from     mknod(2) can create files pointing to devices on a     glusterfs server node. An authenticated attacker could     use this to create an arbitrary device and read data     from any device attached to the glusterfs server     node.(CVE-2018-10923)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for glusterfs fixes the following issues :

glusterfs was update to release 3.12.15 :

  - Fixed a number of bugs and security issues :

  - CVE-2018-1088, CVE-2018-1112 [boo#1090084],     CVE-2018-10904 [boo#1107018], CVE-2018-10907     [boo#1107019], CVE-2018-10911 [boo#1107020],     CVE-2018-10913 [boo#1107021], CVE-2018-10914     [boo#1107022], CVE-2018-10923 [boo#1107023],     CVE-2018-10924 [boo#1107024], CVE-2018-10926     [boo#1107025], CVE-2018-10927 [boo#1107026],     CVE-2018-10928 [boo#1107027], CVE-2018-10928     [boo#1107027], CVE-2018-10929 [boo#1107028],     CVE-2018-10930 [boo#1107029], boo#1105776 .

The remote host is affected by the vulnerability described in GLSA-201904-06 (GlusterFS: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in GlusterFS. Please       review the referenced CVE identifiers for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

4.1.5 GA

----

4.1.4 GA Security Fix for CVE-2018-10904 Security Fix for CVE-2018-10907 Security Fix for CVE-2018-10911 Security Fix for CVE-2018-10913 Security Fix for CVE-2018-10914 Security Fix for CVE-2018-10923 Security Fix for CVE-2018-10926 Security Fix for CVE-2018-10927 Security Fix for CVE-2018-10928 Security Fix for CVE-2018-10929 Security Fix for CVE-2018-10930

----

missing /run/gluster/metrics, see bz#1624006

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

4.1.4 GA Security Fix for CVE-2018-10904 Security Fix for CVE-2018-10907 Security Fix for CVE-2018-10911 Security Fix for CVE-2018-10913 Security Fix for CVE-2018-10914 Security Fix for CVE-2018-10923 Security Fix for CVE-2018-10926 Security Fix for CVE-2018-10927 Security Fix for CVE-2018-10928 Security Fix for CVE-2018-10929 Security Fix for CVE-2018-10930

----

missing /run/gluster/metrics, see bz#1624006

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated glusterfs packages that fix multiple security issues and bugs, and add various enhancements are now available for Red Hat Gluster Storage 3.4 on Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system.

Security Fix(es) :

* glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code (CVE-2018-10904)

* glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code (CVE-2018-10907)

* glusterfs: I/O to arbitrary devices on storage server (CVE-2018-10923)

* glusterfs: Device files can be created in arbitrary locations (CVE-2018-10926)

* glusterfs: File status information leak and denial of service (CVE-2018-10927)

* glusterfs: Improper resolution of symlinks allows for privilege escalation (CVE-2018-10928)

* glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code (CVE-2018-10929)

* glusterfs: Files can be renamed outside volume (CVE-2018-10930)

* glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911)

* glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c (CVE-2018-10914)

* glusterfs: Information Exposure in posix_get_file_contents function in posix-helpers.c (CVE-2018-10913)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting these issues.

Additional Changes :

These updated glusterfs packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Gluster Storage 3.4 Release Notes for information on the most significant of these changes :

https://access.redhat.com/site/documentation/en-US/red_hat_gluster_sto rage/3.4/ html/3.4_release_notes/

All users of Red Hat Gluster Storage are advised to upgrade to these updated packages, which provide numerous bug fixes and enhancements.

An update for imgbased, redhat-release-virtualization-host, and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor.
Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks.

Security Fix(es) :

* spice: Missing check in demarshal.py:write_validate_array_item() allows for buffer overflow and denial of service (CVE-2018-10873)

* glusterfs: Multiple flaws (CVE-2018-10904, CVE-2018-10907, CVE-2018-10923, CVE-2018-10926, CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, CVE-2018-10911, CVE-2018-10914, CVE-2018-14652, CVE-2018-14653, CVE-2018-14654, CVE-2018-14659, CVE-2018-14660, CVE-2018-14661, CVE-2018-10913)

* samba: Insufficient input validation in libsmbclient (CVE-2018-10858)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting CVE-2018-10904, CVE-2018-10907, CVE-2018-10923, CVE-2018-10926, CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, CVE-2018-10911, CVE-2018-10914, CVE-2018-14652, CVE-2018-14653, CVE-2018-14654, CVE-2018-14659, CVE-2018-14660, CVE-2018-14661, and CVE-2018-10913. The CVE-2018-10873 issue was discovered by Frediano Ziglio (Red Hat).

Bug Fix(es) :

* When upgrading Red Hat Virtualization Host (RHVH), imgbased fails to run garbage collection on previous layers, so new logical volumes are removed, and the boot entry points to a logical volume that was removed.

If the RHVH upgrade finishes successfully, the hypervisor boots successfully, even if garbage collection fails. (BZ#1632058)

* During the upgrade process, when lvremove runs garbage collection, it prompts for user confirmation, causing the upgrade process to fail.
Now the process uses 'lvremove --force' when trying to remove logical volumes and does not fail even if garbage collection fails, and as a result, the upgrade process finishes successfully. (BZ#1632585)

3.12.14 GA Security Fix for CVE-2018-10904 Security Fix for CVE-2018-10907 Security Fix for CVE-2018-10911 Security Fix for CVE-2018-10913 Security Fix for CVE-2018-10914 Security Fix for CVE-2018-10923 Security Fix for CVE-2018-10926 Security Fix for CVE-2018-10927 Security Fix for CVE-2018-10928 Security Fix for CVE-2018-10929 Security Fix for CVE-2018-10930

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security vulnerabilities were discovered in GlusterFS, a clustered file system. Buffer overflows and path traversal issues may lead to information disclosure, denial of service or the execution of arbitrary code.

To resolve the security vulnerabilities the following limitations were made in GlusterFS :

  - open,read,write on special files like char and block are     no longer permitted

  - io-stat xlator can dump stat info only to /run/gluster     directory

For Debian 8 'Jessie', these problems have been fixed in version 3.5.2-2+deb8u4.

We recommend that you upgrade your glusterfs packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated glusterfs packages that fix multiple security issues, several bugs, and adds various enhancements are now available for Red Hat Gluster Storage 3.4 on Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system.

Security Fix(es) :

* glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code (CVE-2018-10904)

* glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code (CVE-2018-10907)

* glusterfs: I/O to arbitrary devices on storage server (CVE-2018-10923)

* glusterfs: Device files can be created in arbitrary locations (CVE-2018-10926)

* glusterfs: File status information leak and denial of service (CVE-2018-10927)

* glusterfs: Improper resolution of symlinks allows for privilege escalation (CVE-2018-10928)

* glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code (CVE-2018-10929)

* glusterfs: Files can be renamed outside volume (CVE-2018-10930)

* glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911)

* glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c (CVE-2018-10914)

* glusterfs: Information Exposure in posix_get_file_contents function in posix-helpers.c (CVE-2018-10913)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting these issues.

Additional changes :

These updated Red Hat Gluster Storage packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Gluster Storage 3.4 Release Notes for information on the most significant of these changes :

https://access.redhat.com/documentation/en-us/red_hat_gluster_storage/ 3.4/html/ 3.4_release_notes/

All users of Red Hat Gluster Storage are advised to upgrade to these updated packages, which provide numerous bug fixes and enhancements.

Disabled on 2018/11/06. Detection of Gluster Storage Server on RHEL 6 is no longer possible due to changes in Gluster package versioning.

ID	Name	Product	Family	Severity
137939	EulerOS Virtualization 3.0.6.0 : glusterfs (EulerOS-SA-2020-1720)	Nessus	Huawei Local Security Checks	medium
136228	EulerOS Virtualization for ARM 64 3.0.2.0 : glusterfs (EulerOS-SA-2020-1525)	Nessus	Huawei Local Security Checks	medium
133904	EulerOS 2.0 SP5 : glusterfs (EulerOS-SA-2020-1103)	Nessus	Huawei Local Security Checks	medium
133132	openSUSE Security Update : glusterfs (openSUSE-2020-79)	Nessus	SuSE Local Security Checks	high
123580	GLSA-201904-06 : GlusterFS: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
120672	Fedora 29 : glusterfs (2018-a54270a213)	Nessus	Fedora Local Security Checks	medium
120410	Fedora 28 : glusterfs (2018-4e660226e7)	Nessus	Fedora Local Security Checks	medium
118982	CentOS 7 : glusterfs (CESA-2018:2607)	Nessus	CentOS Local Security Checks	medium
118790	RHEL 7 : Virtualization Manager (RHSA-2018:3470)	Nessus	Red Hat Local Security Checks	high
117841	Fedora 27 : glusterfs (2018-9a4d7ec61e)	Nessus	Fedora Local Security Checks	medium
117618	Debian DLA-1510-1 : glusterfs security update	Nessus	Debian Local Security Checks	medium
117318	RHEL 6 : Gluster Storage (RHSA-2018:2608) (deprecated)	Nessus	Red Hat Local Security Checks	medium
117317	RHEL 7 : Gluster Storage (RHSA-2018:2607)	Nessus	Red Hat Local Security Checks	medium

CVE-2018-10913

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Configuration 2

Tenable Plugins