GlusterFS (brick, server-rpc-fops.c): Multiple stack buffer overflows from fixed-size alloca() allocations in the brick

Impact

Multiple stack buffer overflows from fixed-size alloca() allocations in the brick RPC handlers. An authenticated client overflows the brick's stack and gets code execution on the storage server, which owns the data of every tenant on that node.

Who can reach it

Any authenticated gluster client that can mount a volume and send RPCs to a brick.

What to do

Upgrade glusterfs server to the fixed release and restart the brick processes. Confirm the build has stack protector and FORTIFY_SOURCE enabled, and keep brick ports reachable only from known client subnets.

References