CVE-2022-48340: 
NixOS vulnerability analysis and mitigation

A use-after-free vulnerability was discovered in GlusterFS version 11.0, specifically in the dhtsetxattrmds_cbk function within the xlators/cluster/dht/src/dht-common.c file. The vulnerability was assigned CVE-2022-48340 and was publicly disclosed in February 2023 (NVD).

The vulnerability is classified as a heap-use-after-free issue in the dhtsetxattrmds_cbk function. It received a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating that it is network-accessible, requires low attack complexity, needs no privileges or user interaction, and primarily impacts system availability (NVD).

The vulnerability can lead to a denial of service condition when exploited. When triggered, it causes the GlusterFS client to crash, potentially disrupting file system operations and affecting system availability (Ubuntu Security).

The vulnerability has been fixed in multiple versions across different distributions. Ubuntu has released patches for versions 23.10 (10.3-5ubuntu0.1), 23.04 (10.3-4ubuntu0.2), and 22.04 LTS (10.1-1ubuntu0.2). Fedora has addressed the issue in version 10.4-1.fc37 (Fedora Update).