Description
tcmu-runner version 1.0.5 to 1.2.0 is vulnerable to a dbus triggered NULL pointer dereference in the tcmu-runner daemon's on_unregister_handler() function resulting in denial of service
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Gluster Storage 3 | libtcmu +2 | 1.2.0-16.el7rhgs | RHSA-2017:3277 |
Advisories 1
- RHSA-2017:3277 Red Hat Security Advisory: tcmu-runner security update Red Hat Security Advisories (RHSA) · May 13, 2026