Description
The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a "00000000" fragment header.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glusterfs | 3.5.2-2 | — |
| Debian 13 | glusterfs | 3.5.2-2 | — |
| Debian 12 | glusterfs | 3.5.2-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | glusterfs | 3.13.2-1ubuntu1+esm1 | USN-4770-1 |
| Ubuntu Pro 16.04 LTS | glusterfs | 3.7.6-1ubuntu1+esm1 | USN-4770-1 |
| Ubuntu Pro 14.04 LTS | glusterfs | 3.4.2-1ubuntu1+esm1 | USN-4770-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Common 7 | glusterfs +6 | 3.6.0.42-1.el7 | RHBA-2015:0040 |
| Red Hat Gluster Storage 3 | gluster-nagios-addons | 0.1.14-1.el6rhs | RHBA-2015:0038 |
| Red Hat Gluster Storage 3 | gluster-nagios-common | 0.1.4-1.el6rhs | RHBA-2015:0038 |
| Red Hat Gluster Storage 3 | glusterfs +6 | 3.6.0.42-1.el6 | RHBA-2015:0038 |
| Red Hat Gluster Storage 3 | glusterfs-cli +2 | 3.6.0.42-1.el6rhs | RHBA-2015:0038 |
| Red Hat Gluster Storage 3 | gstatus | 0.62-1.el6rhs | RHBA-2015:0038 |
| Red Hat Gluster Storage 3 | openstack-swift +5 | 1.13.1-2.el6ost | RHBA-2015:0038 |
| Red Hat Gluster Storage 3 | openstack-swift-plugin-swift3 | 1.7-3.el6ost | RHBA-2015:0038 |
| Red Hat Gluster Storage 3 | python-paste-deploy | 1.5.0-10.el6ost | RHBA-2015:0038 |
| Red Hat Gluster Storage 3 | python-swiftclient +1 | 2.1.0-2.el6ost | RHBA-2015:0038 |
| Red Hat Gluster Storage 3 | redhat-storage-server | 3.0.3.4-1.el6rhs | RHBA-2015:0038 |
| Red Hat Gluster Storage 3 | samba +12 | 3.6.509-169.4.el6rhs | RHBA-2015:0038 |
| Red Hat Gluster Storage 3 | swiftonfile | 1.13.1-2.el6rhs | RHBA-2015:0038 |
| Red Hat Gluster Storage 3 | vdsm +14 | 4.14.7.3-1.el6rhs | RHBA-2015:0038 |
| Red Hat Gluster Storage 2 | glusterfs +6 | 3.6.0.42-1.el5 | RHBA-2015:0038 |
Advisories 3
- USN-4770-1 glusterfs vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- RHBA-2015:0038 Red Hat Bug Fix Advisory: Red Hat Storage 3.0 enhancement and bug fix update #3 Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHBA-2015:0040 Red Hat Bug Fix Advisory: glusterfs enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- http://review.gluster.org/#/c/8662/4
- https://bugzilla.redhat.com/show_bug.cgi?id=1138145
- MDVSA-2015:211 vendor-advisory
- http://advisories.mageia.org/MGASA-2015-0145.html
- openSUSE-SU-2015:0473 vendor-advisory
- openSUSE-SU-2015:0528 vendor-advisory