CVE-2018-1088
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 5.5%
exploitation probability
5.5%top 8% of all CVEs
observed exploitation
nono source reports it
A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink.
Affected products
Red Hat, Inc. · glusterfsReferences
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.htmlhttps://access.redhat.com/errata/RHSA-2018:1136https://access.redhat.com/errata/RHSA-2018:1137https://access.redhat.com/errata/RHSA-2018:1275https://access.redhat.com/errata/RHSA-2018:1524https://bugzilla.redhat.com/show_bug.cgi?id=1558721https://lists.debian.org/debian-lts-announce/2021/11/msg00000.htmlhttps://security.gentoo.org/glsa/201904-06