Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Red Hat: RHSA-2018-1137-01 Important: GlusterFS Escalation Risk

red hat
Calendar Grey April 18, 2018
Scroller Redhat
A critical patch for glusterfs in Red Hat Enterprise Linux 6 resolves vulnerabilities related to privilege elevation. More information is available here.
An update for glusterfs is now available for Native Client for Red Hat Enterprise Linux 6 for Red Hat Storage and Red Hat Gluster Storage 3.3 for Red Hat Enterprise Linux 6

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system.
Security Fix(es):
* glusterfs: Privilege escalation via gluster_shared_storage when snapshot scheduling is enabled (CVE-2018-1088)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
This issue was discovered by John Strunk (Red Hat).

Topics%20covered

Topics Covered

security advisory Red Hat privilege escalation storage security glusterfs

References

https://access.redhat.com/security/cve/CVE-2018-1088 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/articles/3414511

Package List

Red Hat Gluster Storage Server 3.3 on RHEL-6:
Source: glusterfs-3.8.4-54.7.el6rhs.src.rpm
noarch: python-gluster-3.8.4-54.7.el6rhs.noarch.rpm
x86_64: glusterfs-3.8.4-54.7.el6rhs.x86_64.rpm glusterfs-api-3.8.4-54.7.el6rhs.x86_64.rpm glusterfs-api-devel-3.8.4-54.7.el6rhs.x86_64.rpm glusterfs-cli-3.8.4-54.7.el6rhs.x86_64.rpm glusterfs-client-xlators-3.8.4-54.7.el6rhs.x86_64.rpm glusterfs-debuginfo-3.8.4-54.7.el6rhs.x86_64.rpm glusterfs-devel-3.8.4-54.7.el6rhs.x86_64.rpm glusterfs-events-3.8.4-54.7.el6rhs.x86_64.rpm glusterfs-fuse-3.8.4-54.7.el6rhs.x86_64.rpm glusterfs-ganesha-3.8.4-54.7.el6rhs.x86_64.rpm glusterfs-geo-replication-3.8.4-54.7.el6rhs.x86_64.rpm glusterfs-libs-3.8.4-54.7.el6rhs.x86_64.rpm glusterfs-rdma-3.8.4-54.7.el6rhs.x86_64.rpm glusterfs-server-3.8.4-54.7.el6rhs.x86_64.rpm
Red Hat Storage Native Client for Red Hat Enterprise Linux 6:
Source: glusterfs-3.8.4-54.7.el6.src.rpm
noarch: python-gluster-3.8.4-54.7.el6.noarch.rpm
x86_64: glusterfs-3.8.4-54.7.el6.x86_64.rpm glusterfs-api-3.8.4-54.7.el6.x86_64.rpm glusterfs-api-devel-3.8.4-54.7.el6.x86_64.rpm glusterfs-cli-3.8.4-54.7.el6.x86_64.rpm glusterfs-client-xlators-3.8.4-54.7.el6.x86_64.rpm glusterfs-debuginfo-3.8.4-54.7.el6.x86_64.rpm glusterfs-devel-3.8.4-54.7.el6.x86_64.rpm

Read the Full Advisory


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2018:1137-01
Product: Red Hat Gluster Storage
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1137
Issue date: 2018-04-18

Topic

An update for glusterfs is now available for Native Client for Red HatEnterprise Linux 6 for Red Hat Storage and Red Hat Gluster Storage 3.3 forRed Hat Enterprise Linux 6.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory Red Hat privilege escalation storage security glusterfs

Relevant Releases Architectures

Red Hat Gluster Storage Server 3.3 on RHEL-6 - noarch, x86_64

Red Hat Storage Native Client for Red Hat Enterprise Linux 6 - noarch, x86_64

Bugs Fixed

1558721 - CVE-2018-1088 glusterfs: Privilege escalation via gluster_shared_storage when snapshot scheduling is enabled

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.