RedHat: RHSA-2018-3432:01 Important: glusterfs security and bug fix update
Summary
GlusterFS is a key building block of Red Hat Gluster Storage. It is based
on a stackable user-space design and can deliver exceptional performance
for diverse workloads. GlusterFS aggregates various storage servers over
network interconnections into one large, parallel network file system.
Security Fix(es):
* glusterfs: glusterfs server exploitable via symlinks to relative paths
(CVE-2018-14651)
* glusterfs: Buffer overflow in "features/locks" translator allows for
denial of service (CVE-2018-14652)
* glusterfs: Heap-based buffer overflow via "gf_getspec_req" RPC message
(CVE-2018-14653)
* glusterfs: "features/index" translator can create arbitrary, empty files
(CVE-2018-14654)
* glusterfs: Unlimited file creation via "GF_XATTR_IOSTATS_DUMP_KEY" xattr
allows for denial of service (CVE-2018-14659)
* glusterfs: Repeat use of "GF_META_LOCK_KEY" xattr allows for memory
exhaustion (CVE-2018-14660)
* glusterfs: features/locks translator passes an user-controlled string to
snprintf without a proper format string resulting in a denial of service
(CVE-2018-14661)
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.
Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting
these issues.
Bug Fix(es):
* MD5 instances are replaced with FIPS-compliant SHA256 checksums and
glusterd no longer crashes when run on a FIPS enabled machine. (BZ#1459709)
* The flock is unlocked specifically and the status file is updated so that
the reference is not leaked to any worker or agent process. As a result of
this fix, all workers come up without fail. (BZ#1623749)
* All HTIME index files are checked for the specified start and end times,
and the History API does not fail when multiple HTIME files exist.
(BZ#1627639)
* After upgrading to Red Hat Gluster Storage 3.4 from earlier versions of
Red Hat Gluster Storage, the volume size displayed by the df command was
smaller than the actual volume size. This has been fixed and the df command
now shows the correct size for all volumes. (BZ#1630997)
* The algorithm to disable the eager-lock is modified and it disables only
when multiple write operations are trying to modify a file at the same
time. This led to performance improvement while a write operation is
performed on a file irrespective of the number of times it is opened at the
same time for a read operation. (BZ#1630688)
* heal-info does not consider the presence of dirty markers as an
indication of split-brain and does not display these entries to be in a
split-brain state. (BZ#1610743)
All users of Red Hat Gluster Storage are advised to upgrade to these
updated packages, which provide numerous bug fixes and enhancements.
Summary
Solution
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
References
https://access.redhat.com/security/cve/CVE-2018-14651 https://access.redhat.com/security/cve/CVE-2018-14652 https://access.redhat.com/security/cve/CVE-2018-14653 https://access.redhat.com/security/cve/CVE-2018-14654 https://access.redhat.com/security/cve/CVE-2018-14659 https://access.redhat.com/security/cve/CVE-2018-14660 https://access.redhat.com/security/cve/CVE-2018-14661 https://access.redhat.com/security/updates/classification/#important
Package List
Red Hat Gluster Storage Server 3.4 on RHEL-7:
Source:
glusterfs-3.12.2-25.el7rhgs.src.rpm
redhat-storage-server-3.4.1.0-1.el7rhgs.src.rpm
noarch:
glusterfs-resource-agents-3.12.2-25.el7rhgs.noarch.rpm
redhat-storage-server-3.4.1.0-1.el7rhgs.noarch.rpm
x86_64:
glusterfs-3.12.2-25.el7rhgs.x86_64.rpm
glusterfs-api-3.12.2-25.el7rhgs.x86_64.rpm
glusterfs-api-devel-3.12.2-25.el7rhgs.x86_64.rpm
glusterfs-cli-3.12.2-25.el7rhgs.x86_64.rpm
glusterfs-client-xlators-3.12.2-25.el7rhgs.x86_64.rpm
glusterfs-debuginfo-3.12.2-25.el7rhgs.x86_64.rpm
glusterfs-devel-3.12.2-25.el7rhgs.x86_64.rpm
glusterfs-events-3.12.2-25.el7rhgs.x86_64.rpm
glusterfs-fuse-3.12.2-25.el7rhgs.x86_64.rpm
glusterfs-ganesha-3.12.2-25.el7rhgs.x86_64.rpm
glusterfs-geo-replication-3.12.2-25.el7rhgs.x86_64.rpm
glusterfs-libs-3.12.2-25.el7rhgs.x86_64.rpm
glusterfs-rdma-3.12.2-25.el7rhgs.x86_64.rpm
glusterfs-server-3.12.2-25.el7rhgs.x86_64.rpm
python2-gluster-3.12.2-25.el7rhgs.x86_64.rpm
Red Hat Storage Native Client for Red Hat Enterprise Linux 7:
Source:
glusterfs-3.12.2-25.el7.src.rpm
x86_64:
glusterfs-3.12.2-25.el7.x86_64.rpm
glusterfs-api-3.12.2-25.el7.x86_64.rpm
glusterfs-api-devel-3.12.2-25.el7.x86_64.rpm
glusterfs-cli-3.12.2-25.el7.x86_64.rpm
glusterfs-client-xlators-3.12.2-25.el7.x86_64.rpm
glusterfs-debuginfo-3.12.2-25.el7.x86_64.rpm
glusterfs-devel-3.12.2-25.el7.x86_64.rpm
glusterfs-fuse-3.12.2-25.el7.x86_64.rpm
glusterfs-libs-3.12.2-25.el7.x86_64.rpm
glusterfs-rdma-3.12.2-25.el7.x86_64.rpm
python2-gluster-3.12.2-25.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
Topic
Updated glusterfs packages that fix multiple security issues and bugs arenow available for Red Hat Gluster Storage 3.4 on Red Hat Enterprise Linux7.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Red Hat Gluster Storage Server 3.4 on RHEL-7 - noarch, x86_64
Red Hat Storage Native Client for Red Hat Enterprise Linux 7 - x86_64
Bugs Fixed
1610743 - Directory is incorrectly reported as in split-brain when dirty marking is there
1618221 - If a node disconnects during volume delete, it assumes deleted volume as a freshly created volume when it is back online
1619627 - Add performance options to virt profile
1622649 - [RHEL7] Some of the Posix compliance tests are failing on gluster mount
1623749 - Geo-rep: Few workers fails to start with out any failure
1623874 - IO errors on block device post rebooting one brick node
1624444 - Fail volume stop operation in case brick detach request fails
1625622 - [Disperse] Improve log messages for EC volume while getting/setting xattrs and finding good child to wind
1626780 - sas workload job getting stuck after sometime
1627098 - RFE: make fuse dumping available as mount option
1627617 - SAS job aborts complaining about file doesn't exist
1627639 - libgfchangelog: History API fails
1630688 - Low Random write IOPS in VM in RHHI 2.0
1631329 - rpc marks brick disconnected from glusterd
1631372 - glusterfsd keeping fd open in index xlator after stop the volume
1631576 - CVE-2018-14654 glusterfs: "features/index" translator can create arbitrary, empty files
1632557 - CVE-2018-14651 glusterfs: glusterfs server exploitable via symlinks to relative paths
1632974 - CVE-2018-14652 glusterfs: Buffer overflow in "features/locks" translator allows for denial of service
1633431 - CVE-2018-14653 glusterfs: Heap-based buffer overflow via "gf_getspec_req" RPC message
1635926 - CVE-2018-14660 glusterfs: Repeat use of "GF_META_LOCK_KEY" xattr allows for memory exhaustion
1635929 - CVE-2018-14659 glusterfs: Unlimited file creation via "GF_XATTR_IOSTATS_DUMP_KEY" xattr allows for denial of service
1636880 - CVE-2018-14661 glusterfs: features/locks translator passes an user-controlled string to snprintf without a proper format string resulting in a denial of service
1636902 - "gluster vol heal
1640135 - Wrong version number in /etc/redhat-storage-release
1641489 - [Brick-Mux] gluster vol stop fails with Error : Request timed out.
1641586 - spec: wrong release number for RHGS 3.4.1 in /usr/share/glusterfs/release
1643355 - [RHEL7] update with entitlement certificate for RHEL 7.6