CVE-2022-48340 Use after free in n/a

What is CVE-2022-48340?

CVE-2022-48340 is a high-severity use after free vulnerability in n/a, published on 21 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Gluster GlusterFS 11.0, there is an xlators/cluster/dht/src/dht-common.c dht_setxattr_mds_cbk use-after-free.

Weakness: CWE-416

Which versions are affected by CVE-2022-48340?

It affects 1 product.

Products include Gluster Glusterfs.

How do I fix CVE-2022-48340?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2022-48340 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-48340 exists.

Other vulnerabilities in n/a

• CVE-2018-1112 Auth bypass in glusterfs High 8.0
• CVE-2023-26253 Memory corruption in n/a High 7.5
• CVE-2018-10924 Denial of service in glusterfs Medium 5.3
• CVE-2014-3619 Denial of service in n/a Medium 5.0
• CVE-2012-4417 Path traversal in n/a Low 3.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLSA-2026-1781080101, CLSA-2026-1781177494, CLSA-2026-1782151075, CLSA-2026-1782151296, DEBIAN-CVE-2022-48340, GHSA-wqf4-gccr-fcx6 and 7 more.