GlusterFS (brick, mknod): Mknod can create device nodes that point at real devices on the storage server, so a client

Impact

Mknod can create device nodes that point at real devices on the storage server, so a client creates a block-device node inside the volume and reads raw disk. That bypasses the file layer entirely and exposes every tenant's data sitting on the same physical device.

Who can reach it

Any authenticated gluster client that can mount a volume and call mknod.

What to do

Upgrade glusterfs server and restart the bricks. Mount client-side with nodev where the workload allows, and confirm the brick process is not running with the capabilities needed to open raw devices.

References