CVE-2018-10911: debian debian_linux Integer Overflow or Wraparound
CVSS: 7.5v3.1HighModified
AliasesRHSA-2018:2892RHSA-2018:3242UBUNTU-CVE-2018-10911DEBIAN-CVE-2018-10911
Published 04-09-2018Last modified 05-08-2024
Vulnerability summary
CVE-2018-10911 is a high (CVSS 7.5) Integer Overflow or Wraparound vulnerability in debian debian_linux. EPSS estimates a 3.07% chance of exploitation in the next 30 days, higher than 87.4% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
3.07%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 7 · Related 2Timeline
- 04-09-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this flaw to read memory from other locations into the stored dict value.
CVSS metrics
8 scores · 5 sources · 3 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Medium 6.5Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NSources4 sources · 6.5–7.5
- NVDNIST6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · Red hatEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
3.07%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
0.00 pp
From 3.07% on 18-09-2026
18-09-202618-10-2026
EPSS score3.07%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected systems
Redhat15 products
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_workstation6.0 | 7.0
- virtualization_host4.0
- glusterfs< 0:3.12.2-18.el6 | < 0:3.12.2-18.el7
Debian2 products
- glusterfs< 4.1.4-1
- debian_linuxEOL8.0 | 9.0
Gluster1 product
- glusterfs≥ 3.12.0, < 3.12.14 | ≥ 4.1.0, < 4.1.8
Opensuse1 product
- leapEOL15.1
Red hat1 product
- glusterfs:n/a
Ubuntu1 product
- glusterfs< 3.4.2-1ubuntu1+esm1 | < 3.7.6-1ubuntu1+esm1 | < 3.13.2-1ubuntu1+esm1
6 vendors · 21 products
References
25 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10911X Refsource CONFIRMIssue TrackingThird Party AdvisoryREPORT
lists.debian.org/debian-lts-announce/2018/09/msg00021.htmlMailing ListX Refsource MLISTThird Party Advisory- access.redhat.com/errata/RHSA-2018:2892Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- access.redhat.com/errata/RHSA-2018:3242Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 25 references
- lists.debian.org/debian-lts-announce/2021/11/msg00000.htmlMailing ListX Refsource MLISTThird Party Advisory
- review.gluster.org/21067REPORT