CVE-2018-10924 Denial of service in glusterfs
An authenticated attacker can cause a denial of service by triggering a memory leak in the GlusterFS client's fsync implementation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-10924?
CVE-2018-10924 is a medium-severity denial of service vulnerability in Red Hat glusterfs, published on 4 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It was discovered that fsync(2) system call in glusterfs client code leaks memory. An authenticated attacker could use this flaw to launch a denial of service attack by making gluster clients consume memory of the host machine.
Which versions are affected by CVE-2018-10924?
It affects 1 product.
Products include Gluster Glusterfs.
How do I fix CVE-2018-10924?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-10924 being exploited?
There is no known exploitation of CVE-2018-10924 in the wild and no public exploit code.
Other vulnerabilities in Red Hat glusterfs
Sources
Also known as DEBIAN-CVE-2018-10924, GHSA-cjxq-5pxf-g82j, UBUNTU-CVE-2018-10924.