CVE-2018-14659 MEDIUM

CVE-2018-14659

Vendor The Gluster Project

Product glusterfs

Weakness CWE-400

Published October 31, 2018

Last update August 5, 2024

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GF_XATTR_IOSTATS_DUMP_KEY' xattr. A remote, authenticated attacker could exploit this by mounting a Gluster volume and repeatedly calling 'setxattr(2)' to trigger a state dump and create an arbitrary number of files in the server's runtime directory.

Key dates

02Disclosure timeline

October 31, 2018 CVE published

August 5, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2018-14659 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/400.html

Related vulnerabilities

04Related CVE

CVE-2024-1410 Unbounded storage of information related to connection ID retirement, in quiche CVE-2022-43564 Denial of Service in Splunk Enterprise through search macros CVE-2024-3056 Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack CVE-2018-15383 Cisco Adaptive Security Appliance Direct Memory Access Denial of Service Vulnerability CVE-2018-0381 Cisco Aironet 1560, 1800, 2800, and 3800 Series Access Points Denial of Service Vulnerability