GlusterFS (dict_unserialize): A negative key length in a serialized dict makes the server read memory from elsewhere in

Impact

A negative key length in a serialized dict makes the server read memory from elsewhere in the process into a returned value. The client gets back chunks of brick process memory, which on a shared brick can contain other tenants' file data and credentials.

Who can reach it

Any authenticated gluster client able to send a crafted RPC to a brick.

What to do

Upgrade glusterfs to 4.1.4 / 3.12.x-fixed or later and restart the bricks. Rotate any secrets that lived in the brick process address space if you believe the flaw was exercised.

References