CVE-2018-14660

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_LOCK_KEY xattr. A remote, authenticated attacker could use this flaw to create multiple locks for single inode by using setxattr repetitively resulting in memory exhaustion of glusterfs server node.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-770

Affected software

Vendor	Product	Versions
[UNKNOWN]	glusterfs	affected versions through 4.1.4; affected versions through 3.1.2

References

https://access.redhat.com/errata/RHSA-2018:3431Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3432Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3470Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14660Issue Tracking, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00000.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201904-06Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3431Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3432Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3470Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14660Issue Tracking, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00000.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201904-06Third Party Advisory

Timeline

Published: Nov 1, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-146616.5It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped with Red Hat Gluster Storage,CVE-2018-146625.7It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used CVE-2018-146635.9An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the ad CVE-2018-146645.4A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in CVE-2018-146656.6A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X CVE-2018-146667.2An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host r CVE-2018-146679.8The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unaut CVE-2018-146688.8In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which CVE-2018-146697.5ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database CVE-2018-14677.5The IBM Storwize V7000 Unified management Web interface 1.6 exposes internal cluster details to unauthenticated users. IBM X-Force ID: 14039 CVE-2018-146709.8Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database.CVE-2018-146719.8In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vu