CVE-2022-48340

2023-02-2102:15:10

Debian Security Bug Tracker

security-tracker.debian.org

cve-2022-48340

glusterfs

use-after-free

vulnerability

dht_setxattr_mds_cbk

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

31.0%

JSON

In Gluster GlusterFS 11.0, there is an xlators/cluster/dht/src/dht-common.c dht_setxattr_mds_cbk use-after-free.

OSVersionArchitecturePackageVersionFilename
Debian12allglusterfs<= 10.3-5glusterfs_10.3-5_all.deb
Debian11allglusterfs<= 9.2-1glusterfs_9.2-1_all.deb
Debian999allglusterfs< 11.1-1glusterfs_11.1-1_all.deb
Debian13allglusterfs< 11.1-1glusterfs_11.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	glusterfs	<= 10.3-5	glusterfs_10.3-5_all.deb
Debian	11	all	glusterfs	<= 9.2-1	glusterfs_9.2-1_all.deb
Debian	999	all	glusterfs	< 11.1-1	glusterfs_11.1-1_all.deb
Debian	13	all	glusterfs	< 11.1-1	glusterfs_11.1-1_all.deb