Database/Control plane, storage & DevOps
GlusterFS (dht translator, dht_setxattr_mds_cbk): A use-after-free in the distributed-hash translator crashes the brick
Impact
A use-after-free in the distributed-hash translator crashes the brick process. With brick multiplexing enabled one crash takes down several volumes at once, so a single tenant can stall storage for unrelated jobs.
Who can reach it
Reachable over the network against GlusterFS 11.0 without authentication per the CVSS assessment; in practice any client that can drive setxattr traffic to a brick.
What to do
Upgrade past GlusterFS 11.0 to a release carrying the dht fix and restart the bricks. Consider disabling brick multiplexing on multi-tenant volumes so a crash is contained to one volume.
References
Related entries
- AMD SMM communications buffer - TOCTOU (AMD-SB-3003): A time-of-check-to-time-of-use race on the SMM communicationsCVE-2023-20578 · AMD SMM communications buffer - TOCTOU (AMD-SB-3003)High
- NetApp ONTAP 9 HTTP service: An unauthenticated attacker crashes the ONTAP HTTP service, taking down the management andCVE-2023-27314 · NetApp ONTAP 9 HTTP serviceHigh
- Veeam Backup & Replication: Encrypted credentials in the configuration database can be obtainedCVE-2023-27532 · Veeam Backup & ReplicationHigh
- MinIO: Cluster returns all env vars incl. MINIO_SECRET_KEY and MINIO_ROOT_PASSWORDCVE-2023-28432 · MinIOHigh
- Software House iSTAR Ultra, Ultra LT, Ultra G2 and Edge G2 door controllers: An unauthenticated user can logCVE-2023-3127 · Software House iSTAR Ultra, Ultra LT, Ultra G2 and Edge G2 door controllersHigh
- AMD Radeon Graphics display driver - input validation: Improper input validation in the Radeon display driver letsCVE-2023-31320 · AMD Radeon Graphics display driver - input validationHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.