GlusterFS is vulnerable to multiple stack-based buffer overflows due to functions in server-rpc-fops.c allocating fixed-size buffers using 'alloca(3)'. A remote attacker could expliot this by mounting a Gluster volume and sending a string longer than the fixed buffer to cause a crash or potential code execution.

GlusterFS does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute (xattr) as used by the "debug/io-stats" translator. The value of this extended attribute is not properly sanitized and can be exploited by an attacker to create files in arbitrary locations and subsequently execute arbitrary code. To exploit this an attacker would require sufficient access to modify the extended attributes of files on a Gluster volume.

It was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs server node. An authenticated attacker could use this to create an arbitrary device and read data from any device attached to the glusterfs server node.

A flaw was found in the way dicunserialize function of glusterfs does not handle negative key length values. An attacker could use this flaw to read memory from other locations into the stored dict value.

A flaw was found in GlusterFS. A NULL pointer dereference vulnerability due to an improper implementation of the posixgetfilecontents function. An attacker could exploit this to perform a Denial of Service attack.

A flaw was found in GlusterFS. An Information Exposure vulnerability due to an improper implementation of the glusterfs.file function. An attacker could exploit this to obtain information about the files available.