The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GFXATTRIOSTATSDUMPKEY' xattr. A remote, authenticated attacker could exploit this by mounting a Gluster volume and repeatedly calling 'setxattr(2)' to trigger a state dump and create an arbitrary number of files in the server's runtime directory.
{ "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "3.4.2-1ubuntu1+esm1", "binary_name": "glusterfs-client" }, { "binary_version": "3.4.2-1ubuntu1+esm1", "binary_name": "glusterfs-client-dbgsym" }, { "binary_version": "3.4.2-1ubuntu1+esm1", "binary_name": "glusterfs-common" }, { "binary_version": "3.4.2-1ubuntu1+esm1", "binary_name": "glusterfs-common-dbgsym" }, { "binary_version": "3.4.2-1ubuntu1+esm1", "binary_name": "glusterfs-dbg" }, { "binary_version": "3.4.2-1ubuntu1+esm1", "binary_name": "glusterfs-server" }, { "binary_version": "3.4.2-1ubuntu1+esm1", "binary_name": "glusterfs-server-dbgsym" } ] }
{ "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "3.7.6-1ubuntu1+esm1", "binary_name": "glusterfs-client" }, { "binary_version": "3.7.6-1ubuntu1+esm1", "binary_name": "glusterfs-client-dbgsym" }, { "binary_version": "3.7.6-1ubuntu1+esm1", "binary_name": "glusterfs-common" }, { "binary_version": "3.7.6-1ubuntu1+esm1", "binary_name": "glusterfs-common-dbgsym" }, { "binary_version": "3.7.6-1ubuntu1+esm1", "binary_name": "glusterfs-dbg" }, { "binary_version": "3.7.6-1ubuntu1+esm1", "binary_name": "glusterfs-server" }, { "binary_version": "3.7.6-1ubuntu1+esm1", "binary_name": "glusterfs-server-dbgsym" } ] }
{ "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "3.13.2-1ubuntu1+esm1", "binary_name": "glusterfs-client" }, { "binary_version": "3.13.2-1ubuntu1+esm1", "binary_name": "glusterfs-client-dbgsym" }, { "binary_version": "3.13.2-1ubuntu1+esm1", "binary_name": "glusterfs-common" }, { "binary_version": "3.13.2-1ubuntu1+esm1", "binary_name": "glusterfs-common-dbgsym" }, { "binary_version": "3.13.2-1ubuntu1+esm1", "binary_name": "glusterfs-server" }, { "binary_version": "3.13.2-1ubuntu1+esm1", "binary_name": "glusterfs-server-dbgsym" } ] }