CVE-2022-0563: kernel util-linux
Vulnerability summary
CVE-2022-0563 is a medium (CVSS 5.5) vulnerability in kernel util-linux. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 21-02-2022PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
0.00 pp
From 0.43% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- util-linux< 2.37.4-r0
Debian1 product
- util-linuxAll versions (No fix recorded)
Kernel1 product
- util-linux< 2.37.4
Netapp1 product
Opensuse1 product
- util-linux&distro=openSUSE Tumbleweed< 2.37.4-1.1
5 vendors · 5 products
References
8 links- security.netapp.com/advisory/ntap-20220331-0002/Third Party Advisory
- security.gentoo.org/glsa/202401-08Vendor Advisory
