{"id":"CVE-2018-10924","aliases":["DEBIAN-CVE-2018-10924","EUVD-2018-2978","GHSA-cjxq-5pxf-g82j","UBUNTU-CVE-2018-10924","USN-4770-1","openSUSE-SU-2020:0079-1","openSUSE-SU-2024:10794-1"],"status":"published","title":"It was discovered that fsync(2) system call in glusterfs client code leaks memory. An...","description":"It was discovered that fsync(2) system call in glusterfs client code leaks memory. An authenticated attacker could use this flaw to launch a denial of service attack by making gluster clients consume memory of the host machine.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01898,"percentile":0.79788,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-772"],"published":"2018-09-04T15:00:00Z","modified":"2026-10-24T10:30:37Z","fixes":[{"ecosystem":"Debian:12","package":"glusterfs","fixed_in":["4.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"glusterfs","fixed_in":["4.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"glusterfs","fixed_in":["4.0.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"glusterfs","fixed_in":["3.13.2-1ubuntu1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"glusterfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"glusterfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"glusterfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"glusterfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.2-1ubuntu1+esm1"}]}],"versions":["3.11.2-1","3.12.1-1","3.12.2-1","3.12.2-2","3.12.3-1","3.13.0-1","3.13.2-1","3.13.2-1build1","3.13.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"glusterfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-1ubuntu1+esm1"}]}],"versions":["3.2.7-3ubuntu2","3.4.1-1ubuntu1","3.4.1-2ubuntu1","3.4.2-1ubuntu1"],"bundled":22},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"glusterfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.6-1ubuntu1+esm1"}]}],"versions":["3.7.3-1ubuntu1","3.7.3-1ubuntu2","3.7.6-1ubuntu1"],"bundled":22},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"glusterfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.2-1ubuntu1+esm1"}]}],"versions":["3.11.2-1","3.12.1-1","3.12.2-1","3.12.2-2","3.12.3-1","3.13.0-1","3.13.2-1","3.13.2-1build1","3.13.2-1ubuntu1"],"bundled":22},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"glusterfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-lp151.3.3.1"}]}],"bundled":14}],"products":[{"vendor":"gluster","product":"glusterfs"},{"vendor":"red hat","product":"glusterfs"},{"vendor":"unspecified","product":"glusterfs"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10924","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://review.gluster.org/#/c/glusterfs/+/20723/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://security.gentoo.org/glsa/201904-06","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10924"},{"url":"https://github.com/advisories/GHSA-cjxq-5pxf-g82j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-10924","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-10924","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1611785","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4770-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-10924","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3619","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10841","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10904","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10907","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10911","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10914","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10923","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10926","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10927","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10928","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10929","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10930","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14651","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14652","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14653","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14654","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14659","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14660","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14661","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RYXEJNKIYS5SFNFG2L23KRFS2ESTUJVD/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1090084","tags":["report"]},{"url":"https://bugzilla.suse.com/1105776","tags":["report"]},{"url":"https://bugzilla.suse.com/1107018","tags":["report"]},{"url":"https://bugzilla.suse.com/1107019","tags":["report"]},{"url":"https://bugzilla.suse.com/1107020","tags":["report"]},{"url":"https://bugzilla.suse.com/1107021","tags":["report"]},{"url":"https://bugzilla.suse.com/1107022","tags":["report"]},{"url":"https://bugzilla.suse.com/1107023","tags":["report"]},{"url":"https://bugzilla.suse.com/1107024","tags":["report"]},{"url":"https://bugzilla.suse.com/1107025","tags":["report"]},{"url":"https://bugzilla.suse.com/1107026","tags":["report"]},{"url":"https://bugzilla.suse.com/1107027","tags":["report"]},{"url":"https://bugzilla.suse.com/1107028","tags":["report"]},{"url":"https://bugzilla.suse.com/1107029","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1112","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-10924","description":"It was discovered that fsync(2) system call in glusterfs client code leaks memory. An authenticated attacker could use this flaw to launch a denial of service attack by making gluster clients consume memory of the host machine.","status":"published","published":"2018-09-04T15:00:00Z","modified":"2024-08-05T07:54:35.541Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:35:01.619448Z"}],"euvd":[{"id":"EUVD-2018-2978","description":"It was discovered that fsync(2) system call in glusterfs client code leaks memory. An authenticated attacker could use this flaw to launch a denial of service attack by making gluster clients consume memory of the host machine.","status":"published","published":"2018-09-04T15:00:00Z","modified":"2024-08-05T07:54:35Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T02:39:57.009215Z"}],"ghsa":[{"id":"GHSA-cjxq-5pxf-g82j","title":"It was discovered that fsync(2) system call in glusterfs client code leaks memory. An...","description":"It was discovered that fsync(2) system call in glusterfs client code leaks memory. An authenticated attacker could use this flaw to launch a denial of service attack by making gluster clients consume memory of the host machine.","status":"published","published":"2022-05-13T01:48:57Z","modified":"2023-02-02T05:01:40Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:51:13.974749Z"}],"nvd":[{"id":"CVE-2018-10924","description":"It was discovered that fsync(2) system call in glusterfs client code leaks memory. An authenticated attacker could use this flaw to launch a denial of service attack by making gluster clients consume memory of the host machine.","status":"published","published":"2018-09-04T15:29:00.273Z","modified":"2026-06-17T01:34:56.037Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-400","CWE-772"],"updated_at":"2026-11-02T14:04:38.672108Z"}],"osv":[{"id":"CVE-2018-10924","description":"It was discovered that fsync(2) system call in glusterfs client code leaks memory. An authenticated attacker could use this flaw to launch a denial of service attack by making gluster clients consume memory of the host machine.","status":"published","published":"2018-09-04T15:29:00.273Z","modified":"2026-10-24T10:30:37.690264845Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"DEBIAN-CVE-2018-10924","description":"It was discovered that fsync(2) system call in glusterfs client code leaks memory. An authenticated attacker could use this flaw to launch a denial of service attack by making gluster clients consume memory of the host machine.","status":"published","published":"2018-09-04T15:29:00.273Z","modified":"2026-10-23T18:02:56.985438015Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"UBUNTU-CVE-2018-10924","description":"It was discovered that fsync(2) system call in glusterfs client code leaks memory. An authenticated attacker could use this flaw to launch a denial of service attack by making gluster clients consume memory of the host machine.","status":"published","published":"2018-09-04T15:29:00Z","modified":"2026-02-04T04:29:22.021678Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"openSUSE-SU-2020:0079-1","title":"Security update for glusterfs","description":"This update for glusterfs fixes the following issues:\n\nglusterfs was update to release 3.12.15:\n\n* Fixed a number of bugs and security issues:\n\n- CVE-2018-1088, CVE-2018-1112 [boo#1090084],\n  CVE-2018-10904 [boo#1107018], CVE-2018-10907 [boo#1107019],\n  CVE-2018-10911 [boo#1107020], CVE-2018-10913 [boo#1107021],\n  CVE-2018-10914 [boo#1107022], CVE-2018-10923 [boo#1107023],\n  CVE-2018-10924 [boo#1107024], CVE-2018-10926 [boo#1107025],\n  CVE-2018-10927 [boo#1107026], CVE-2018-10928 [boo#1107027],\n  CVE-2018-10928 [boo#1107027], CVE-2018-10929 [boo#1107028],\n  CVE-2018-10930 [boo#1107029], boo#1105776 .\n","status":"published","published":"2020-01-19T23:11:30Z","modified":"2026-02-04T03:01:53.366567Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10794-1","title":"glusterfs-9.1-1.3 on GA media","description":"These are all security issues fixed in the glusterfs-9.1-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:56.872053Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-4770-1","title":"glusterfs vulnerabilities","description":"It was discovered that GlusterFS incorrectly handled network requests. An\nattacker could possibly use this issue to cause a denial of service. This issue\nonly affected Ubuntu 14.04 ESM. (CVE-2014-3619)\n\nIt was discovered that GlusterFS incorrectly handled user permissions. An\nauthenticated attacker could possibly use this to add himself to a trusted\nstorage pool and perform privileged operations on volumes. This issue only\naffected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2018-10841)\n\nIt was discovered that GlusterFS incorrectly handled mounting gluster\nvolumes. An attacker could possibly use this issue to also mount shared\ngluster volumes and escalate privileges through malicious cronjobs. This\nissue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2018-1088)\n\nIt was discovered that GlusterFS incorrectly handled file paths. An\nattacker could possibly use this issue to create arbitrary files and\nexecute arbitrary code. (CVE-2018-10904)\n\nIt was discovered that GlusterFS incorrectly handled mounting volumes. An\nattacker could possibly use this issue to cause a denial of service or run\narbitrary code. (CVE-2018-10907)\n\nIt was discovered that GlusterFS incorrectly handled negative key length\nvalues. An attacker could possibly use this issue to obtain sensitive\ninformation. (CVE-2018-10911)\n\nIt was discovered that GlusterFS incorrectly handled FUSE requests. An\nattacker could use this issue to obtain sensitive information.\n(CVE-2018-10913, CVE-2018-10914)\n\nIt was discovered that GlusterFS incorrectly handled the file creation\nprocess. An authenticated attacker could possibly use this issue to create\narbitrary files and obtain sensitive information. (CVE-2018-10923)\n\nIt was discovered that GlusterFS incorrectly handled certain inputs. An\nauthenticated attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-10924)\n\nIt was discovered that GlusterFS incorrectly handled RPC requests. An\nattacker could possibly use this issue to write files to an arbitrary\nlocation and execute arbitrary code. (CVE-2018-10926, CVE-2018-10927,\nCVE-2018-10928, CVE-2018-10929, CVE-2018-10930)\n\nIt was discovered that the fix for CVE-2018-10926, CVE-2018-10927,\nCVE-2018-10928, CVE-2018-10929, CVE-2018-10930 was incomplete. A remote\nauthenticated attacker could possibly use this issue to execute arbitrary\ncode or cause a denial of service. (CVE-2018-14651)\n\nIt was discovered that GlusterFS incorrectly handled certain files. A\nremote authenticated attacker could possibly use this issue to cause a\ndenial of service. (CVE-2018-14652)\n\nIt was discovered that GlusterFS incorrectly handled RPC requests. A remote\nauthenticated attacker could possibly use this issue to cause a denial of\nservice or other unspecified impact. (CVE-2018-14653)\n\nIt was discovered that GlusterFS incorrectly handled mount volumes\noperation. A remote attacker could possibly use this issue to create\narbitrary files. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-14654)\n\nIt was discovered that GlusterFS incorrectly handled certain files. A\nremote authenticated attacker could possibly use this issue to create\narbitrary files. (CVE-2018-14659)\n\nIt was discovered that GlusterFS incorrectly handled certain inputs. A\nremote authenticated attacker could possibly use this is issue to cause a\ndenial of service. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-14660)\n\nIt was discovered that GlusterFS incorrectly handled strings. A remote\nauthenticated attacker could possibly use this issue to cause a denial of\nservice. (CVE-2018-14661)\n","status":"published","published":"2021-03-15T20:13:19Z","modified":"2026-06-29T13:48:13.075405496Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}