GlusterFS (brick, server-rpc-fops.c): Multiple stack buffer overflows from fixed-size alloca() allocations in the brick

Impact

Multiple stack buffer overflows from fixed-size alloca() allocations in the brick RPC handlers. An authenticated client overflows the brick's stack and gets code execution on the storage server, which owns the data of every tenant on that node.

Who can reach it

Any authenticated gluster client that can mount a volume and send RPCs to a brick.

What to do

Upgrade glusterfs server to the fixed release and restart the brick processes. Confirm the build has stack protector and FORTIFY_SOURCE enabled, and keep brick ports reachable only from known client subnets.

References

Related entries

• GlusterFS (brick, gfs3_symlink_req): Symlink creation is not confined to the volume, so a client plants a link pointingCVE-2018-10928 · GlusterFS (brick, gfs3_symlink_req)High
• NetApp Clustered Data ONTAP export policy enforcement (SMBv2/SMBv3): Export policy rules marked read-only are notCVE-2018-5490 · NetApp Clustered Data ONTAP export policy enforcement (SMBv2/SMBv3)High
• Schneider Electric Data Center Expert 7.5.0 and earlier - zip upload: A crafted zip uploaded through the DCE UI canCVE-2018-7807 · Schneider Electric Data Center Expert 7.5.0 and earlier - zip uploadHigh
• CyberPower PowerPanel Business Edition 3.4.0 Agent/Center: Cross-site request forgery across all forms in the webCVE-2019-13071 · CyberPower PowerPanel Business Edition 3.4.0 Agent/CenterHigh
• Cisco Nexus 9000 ACI Mode (LLDP subsystem): A buffer overflow in the LLDP subsystem of Nexus 9000 switches in ACI modeCVE-2019-1901 · Cisco Nexus 9000 ACI Mode (LLDP subsystem)High
• IBM Spectrum Scale management GUI: Any authenticated GUI user - including a low-privilege monitoring account - runsCVE-2019-4715 · IBM Spectrum Scale management GUIHigh