CVE-2018-14652: debian debian_linux Classic Buffer Overflow
CVSS: 6.5v3.0MediumModified
AliasesUBUNTU-CVE-2018-14652DEBIAN-CVE-2018-14652
Published 31-10-2018Last modified 05-08-2024
Vulnerability summary
CVE-2018-14652 is a medium (CVSS 6.5) Classic Buffer Overflow vulnerability in debian debian_linux. EPSS estimates a 2.75% chance of exploitation in the next 30 days, higher than 85.9% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.0 (CVE.org)EPSS score
2.75%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 6 · Related 1Timeline
- 31-10-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the 'features/index' translator via the code handling the 'GF_XATTR_CLRLK_CMD' xattr in the 'pl_getxattr' function. A remote authenticated attacker could exploit this on a mounted volume to cause a denial of service.
CVSS metrics
7 scores · 4 sources · 3 versionsMedium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Medium 6.5Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- NVDNIST6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Medium 4.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
2.75%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
0.00 pp
From 2.75% on 18-09-2026
18-09-202618-10-2026
EPSS score2.75%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
- CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Affected systems
Redhat4 products
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_virtualization4.0
- enterprise_virtualization_host4.0
- gluster_storage≥ 3.0.0, ≤ 3.1.2 | ≥ 4.1.0, ≤ 4.1.8
Debian2 products
- glusterfs< 5.0-1
- debian_linuxEOL8.0 | 9.0
The gluster project1 product
- glusterfs≤ 3.12 and 4.1.4
Ubuntu1 product
- glusterfs< 3.4.2-1ubuntu1+esm1 | < 3.7.6-1ubuntu1+esm1 | < 3.13.2-1ubuntu1+esm1
4 vendors · 8 products
References
13 links
lists.debian.org/debian-lts-announce/2018/11/msg00003.htmlMailing ListX Refsource MLISTThird Party Advisory- bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14652X Refsource CONFIRMIssue TrackingVendor AdvisoryREPORT
- lists.debian.org/debian-lts-announce/2021/11/msg00000.htmlMailing ListX Refsource MLISTThird Party Advisory