GlusterFS Device Creation Vulnerability Exploited by Authenticated Attackers
CVE-2018-10923

7.6HIGH

Key Information:

Vendor
Red Hat
Status
Vendor
CVE Published:
4 September 2018

Summary

An issue was identified in GlusterFS where the 'mknod' system call can be misused to create files that point to devices on a GlusterFS server node. This allows an authenticated attacker to potentially create arbitrary device files, leading to unauthorized access and the ability to read sensitive data from devices connected to the server. Such exploitation underscores the importance of applying security updates and vigilant monitoring of access controls within GlusterFS deployments.

Affected Version(s)

glusterfs

References

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.