CVE-2022-0367: debian debian_linux
CVSS: 7.8v3.1HighModified
AliasesopenSUSE-SU-2022:10196-1UBUNTU-CVE-2022-0367DEBIAN-CVE-2022-0367DLA-3098-1
Published 29-08-2022Last modified 03-11-2025
Vulnerability summary
CVE-2022-0367 is a high (CVSS 7.8) vulnerability in debian debian_linux. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.1% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.8/10
010
High · v3.1 (NVD)EPSS score
0.46%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 29-08-2022PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.
CVSS metrics
3 scores · 3 sources · 1 versionHigh 7.8Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.46%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
0.00 pp
From 0.46% on 20-09-2026
20-09-202620-10-2026
EPSS score0.46%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundLibmodbus
Maturity: poc
Weaknesses
CWE · root cause- CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Debian2 products
- libmodbus< 3.1.4-2+deb10u2 | < 3.1.6-2.1
- debian_linuxEOL10.0
Fedoraproject2 products
Libmodbus1 product
- libmodbus< 3.1.7
Opensuse1 product
- libmodbus&distro=openSUSE Leap 15.4< 3.1.6-bp154.2.3.1
Suse1 product
- libmodbus&distro=SUSE Package Hub 15 SP4< 3.1.6-bp154.2.3.1
Ubuntu1 product
- libmodbusAll versions (No fix recorded)
6 vendors · 8 products
References
11 links- github.com/stephane/libmodbus/issues/614X Refsource MISCREPORTExploitIssue TrackingPatchThird Party Advisory
- github.com/stephane/libmodbus/commit/b4ef4c17d618eba0adccc4c7d9e9a1ef809fc9b6X Refsource MISCREPORTPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2022/09/msg00007.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.opensuse.org/archives/…Advisory