CVE-2018-10924 — glusterfs: Denial-of-service via fsync(2) in Gluster FUSE client

Back Back to CVE browser

MEDIUM

glusterfs: Denial-of-service via fsync(2) in Gluster FUSE client

Published Sep 4, 2018

6.5

MEDIUM

CVSS 3.0

EPSS 1.88%

Description

It was discovered that fsync(2) system call in glusterfs client code leaks memory. An authenticated attacker could use this flaw to launch a denial of service attack by making gluster clients consume memory of the host machine.

Affected products

Vendor Red Hat Product Glusterfs Default
n/a

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Red Hat

Glusterfs

n/a

Version	Status	Constraints

Red Hat Enterprise Linux 6

glusterfs

Not affected
Red Hat Enterprise Linux 7

glusterfs

Not affected
Red Hat Enterprise Linux 8

glusterfs

Not affected
Red Hat Storage 3

glusterfs

Not affected
Red Hat Virtualization 4

glusterfs

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	glusterfs	Not affected	n/a
Red Hat Enterprise Linux 7	glusterfs	Not affected	n/a
Red Hat Enterprise Linux 8	glusterfs	Not affected	n/a
Red Hat Storage 3	glusterfs	Not affected	n/a
Red Hat Virtualization 4	glusterfs	Not affected	n/a

Remediation

Red Hat statement

This issue did not affect the versions of glusterfs as shipped with Red Hat Enterprise Linux 6 and 7, and Red Hat Gluster Storage 3.

Metrics

1.88% 0.01881

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01881

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Table of values (13 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.88% (0.01881)	78.71th	v5 (v2026.06.15)
Jun 15, 2026	1.88% (0.01881)	76.68th	v5 (v2026.06.15)
Mar 30, 2025	0.80% (0.00798)	71.78th	v4 (v2025.03.14)
Mar 29, 2025	2.23% (0.02230)	74.14th	v4 (v2025.03.14)
Mar 17, 2025	0.80% (0.00798)	72.34th	v4 (v2025.03.14)
Dec 12, 2024	0.28% (0.00284)	69.50th	v3 (v2023.03.01)
Feb 8, 2024	0.28% (0.00284)	67.77th	v3 (v2023.03.01)
Sep 3, 2023	0.28% (0.00284)	64.63th	v3 (v2023.03.01)
Mar 7, 2023	0.30% (0.00298)	64.59th	v3 (v2023.03.01)
Mar 6, 2023	0.95% (0.00950)	32.28th	v2 (v2022.01.01)
Feb 4, 2022	0.95% (0.00950)	13.46th	v2 (v2022.01.01)
Feb 3, 2022	1.29% (0.01294)	30.79th	v5 (v2026.06.15)
Apr 14, 2021	1.29% (0.01294)	0.00th	v1

Weaknesses (2)

CWE-400

Uncontrolled Resource Consumption

CWE-772

References (8)

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html
vendor-advisoryx_refsource_SUSE
https://access.redhat.com/security/cve/CVE-2018-10924
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1611785
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10924
x_refsource_CONFIRMIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-10924
https://review.gluster.org/#/c/glusterfs/+/20723/
x_refsource_CONFIRMPatchVendor Advisory
https://security.gentoo.org/glsa/201904-06
vendor-advisoryx_refsource_GENTOO
https://www.cve.org/CVERecord?id=CVE-2018-10924

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html		vendor-advisoryx_refsource_SUSE
https://access.redhat.com/security/cve/CVE-2018-10924		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1611785		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10924		x_refsource_CONFIRMIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-10924
https://review.gluster.org/#/c/glusterfs/+/20723/		x_refsource_CONFIRMPatchVendor Advisory
https://security.gentoo.org/glsa/201904-06		vendor-advisoryx_refsource_GENTOO
https://www.cve.org/CVERecord?id=CVE-2018-10924