Read the docs
TI-2018-10523 Aliases CVE-2018-14660GHSA-p6w5-mv25-26mv

Uncontrolled resource consumption in [UNKNOWN] glusterfs

Priority LOW 34CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-400.

Summary

A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_LOCK_KEY xattr. A remote, authenticated attacker could use this flaw to create multiple locks for single inode by using setxattr repetitively resulting in memory exhaustion of glusterfs server node.

Why it matters now

EPSS 0.02515 84th percentileScored 2026-11-07
Fix Fixed Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
[UNKNOWN]glusterfsaffected versions through 4.1.4; affected versions through 3.1.2—No fix listedCNA
  • glusterfs Vendor[UNKNOWN] Affected affected versions through 4.1.4; affected versions through 3.1.2 Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:gluster:glusterfs:*:*:*:*:*:*:*:*3.1.0 – 3.1.2; 4.1.0 – 4.1.4VulnerableGluster
cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
  • cpe:2.3:a:gluster:glusterfs:*:*:*:*:*:*:*:* Versions 3.1.0 – 3.1.2; 4.1.0 – 4.1.4 Vulnerable ·Gluster
  • cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian

Remediation

Red Hat 3 advisories

  • RHSA-2018:3470 Released 2018-11-05 · Red Hat rating Moderate
    Red Hat Virtualization security and bug fix update
    • RHEL 7-based RHEV-H for RHEV 4 (build requirements) imgbased-1.0.29-1.el7ev, python-imgbased-1.0.29-1.el7ev, redhat-release-virtualization-host-4.2-7.3.el7 +1
    • Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host-4.2-20181026.0.el7_6, redhat-virtualization-host-image-update-4.2-20181026.0.el7_6
  • RHSA-2018:3432 Released 2018-10-31 · Red Hat rating Important
    glusterfs security and bug fix update
    • Red Hat Gluster Storage Server 3.4 on RHEL-7 glusterfs-3.12.2-25.el7rhgs, glusterfs-api-3.12.2-25.el7rhgs, glusterfs-api-devel-3.12.2-25.el7rhgs +13
    • Red Hat Storage Native Client for Red Hat Enterprise Linux 7 glusterfs-3.12.2-25.el7, glusterfs-api-3.12.2-25.el7, glusterfs-api-devel-3.12.2-25.el7 +7
    • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts glusterfs-3.12.2-25.el7, glusterfs-api-3.12.2-25.el7, glusterfs-api-devel-3.12.2-25.el7 +6
  • RHSA-2018:3431 Released 2018-10-31 · Red Hat rating Important
    glusterfs security and bug fix update
    • Red Hat Gluster Storage Server 3.4 on RHEL-6 glusterfs-3.12.2-25.el6rhs, glusterfs-api-3.12.2-25.el6rhs, glusterfs-api-devel-3.12.2-25.el6rhs +12
    • Red Hat Storage Native Client for Red Hat Enterprise Linux 6 glusterfs-3.12.2-25.el6, glusterfs-api-3.12.2-25.el6, glusterfs-api-devel-3.12.2-25.el6 +7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    The Gluster Project glusterfs — RHSA-2018:3431

    6 records Highest priority Priority MEDIUM 2 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2018-10514 Link following in [UNKNOWN] glusterfsPriority MEDIUM 44
    • TI-2018-10516 Heap-based buffer overflow in glusterfsPriority MEDIUM 43
    • TI-2018-10517 Path traversal in glusterfsPriority LOW 34
    Show all 6 records → Advisory →
  • Advisory ·

    The Gluster Project glusterfs — RHSA-2018:3432

    6 records Highest priority Priority MEDIUM 2 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2018-10514 Link following in [UNKNOWN] glusterfsPriority MEDIUM 44
    • TI-2018-10516 Heap-based buffer overflow in glusterfsPriority MEDIUM 43
    • TI-2018-10517 Path traversal in glusterfsPriority LOW 34
    Show all 6 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHEL 7-based RHEV-H for RHEV 4 (build requirements)Fixed RHSA-2018:3470
Red Hat Gluster Storage Server 3.4 on RHEL-6Fixed RHSA-2018:3431
Red Hat Gluster Storage Server 3.4 on RHEL-7Fixed RHSA-2018:3432
Red Hat Storage Native Client for Red Hat Enterprise Linux 6Fixed RHSA-2018:3431
Red Hat Storage Native Client for Red Hat Enterprise Linux 7Fixed RHSA-2018:3432
Red Hat Virtualization 4 Hypervisor for RHEL 7Fixed RHSA-2018:3470
Red Hat Virtualization 4 Management Agent for RHEL 7 HostsFixed RHSA-2018:3432
Not affected: 3 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-14660
  2. 2026-10-03 Alias added: GHSA-p6w5-mv25-26mv

References

Advisory 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences