[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2086549779.1418796.1524054250024.JavaMail.zimbra@redhat.com>
Date: Wed, 18 Apr 2018 08:24:10 -0400 (EDT)
From: Siddharth Sharma <siddharth@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2018-1088 glusterfs: Privilege escalation via
gluster_shared_storage when snapshot scheduling is enabled
Hi,
A flaw was found in glusterfs which can lead to privilege escalation on
gluster server nodes.
This flaw is based on symlink attack. Any glusterfs unauthenticated client
having access to gluster nodes can mount gluster_shared_storage volume which
contains file symlink to /etc/cron.d which is owned by root. After mounting
this shared volume client can schedule malicious cronjob which would run as
root. This would lead to privilege escalation. Symlink is created when gluster
snapshot scheduling is enabled. This requires gluster administrator to run
command "snap_scheduler.py init", this is shipped with glusterfs-server
package.
This flaw was discovered by John Strunk (Red Hat)
Respectfully,
-----------------------------------------------------------------
Siddharth Sharma / Red Hat Product Security / Key ID : 0xD9F6489A
Fingerprint : 6F04 C684 A49C E4CE 8148 E841 CD6F 8E55 D9F6 489A
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
