CVE-2018-10911: A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values

High severity · published Sep 4, 2018

CVE-2018-10911

A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values

7.5

CVSS

2.9%

EPSS

On KEV

Description

A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this flaw to read memory from other locations into the stored dict value.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.9% · higher than 87% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Debian Linux · Debian

8.0; 9.0 · source: NVD

Enterprise Linux Desktop · Redhat

6.0; 7.0 · source: NVD

Enterprise Linux Server · Redhat

6.0; 7.0 · source: NVD

Enterprise Linux Workstation · Redhat

6.0; 7.0 · source: NVD

Glusterfs · Gluster

3.12.0 before 3.12.14; 4.1.0 before 4.1.8 · source: NVD

Leap · Opensuse

15.1 · source: NVD

Virtualization Host · Redhat

4.0 · source: NVD

Affected product

Debian Linux

Debian

All Debian Linux CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2018-10911

CVE.org

https://www.cve.org/CVERecord?id=CVE-2018-10911

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2607

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2608

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2892

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:3242

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:3470