CVE-2017-1000198 - tcmu-runner: glfs handler allows local DoS via crafted CheckConfig strings

HIGH

tcmu-runner: glfs handler allows local DoS via crafted CheckConfig strings

Published Nov 17, 2017

7.5

HIGH

CVSS 3.0

EPSS 1.39%

tcmu-runner daemon version 0.9.0 to 1.2.0 is vulnerable to invalid memory references in the handler_glfs.so handler resulting in denial of service

Red Hat Gluster Storage 3.3 for RHEL 7

tcmu-runner-0:1.2.0-16.el7rhgs

Fixed · RHSA-2017:3277
Red Hat Ceph Storage 2

tcmu-runner

Affected

Product	Package	State	Advisory
Red Hat Gluster Storage 3.3 for RHEL 7	tcmu-runner-0:1.2.0-16.el7rhgs	Fixed	RHSA-2017:3277
Red Hat Ceph Storage 2	tcmu-runner	Affected	n/a

No remediation recorded yet.

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-416

Use After Free

Link	Providers	Tags
https://access.redhat.com/errata/RHSA-2017:3277		vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2017-1000198		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1487246		Issue Tracking
https://github.com/open-iscsi/tcmu-runner/commit/61bd03e600d2abf309173e9186f4d465bb1b7157		x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-1000198
https://www.cve.org/CVERecord?id=CVE-2017-1000198