CVE-2022-23218
Vulnerability Summary
Timeline
Description
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
CVSS Metrics
- v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- v3.1•HIGH•Score: 7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
- v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS Trends
Current EPSS score: 4.73%• Percentile: 91%
Techniques & Countermeasures
- CWE-120•Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
Affected Systems
- debian•glibc
< 2.31-13+deb11u3 | < 2.33-3 | < 2.33-3 | < 2.33-3
- debian•debian_linux
10.0
- gnu•glibc
< 2.31
- oracle•communications_cloud_native_core_unified_data_repository
22.2.0
- oracle•enterprise_operations_monitor
4.3 | 4.4 | 5.0
- redhat•glibc
< 0:2.34-28.el9_0
- redhat•glibc-all-langpacks
< 0:2.34-28.el9_0
- redhat•glibc-benchtests
< 0:2.34-28.el9_0
- redhat•glibc-benchtests-debuginfo
< 0:2.34-28.el9_0 | < 0:2.34-28.el9_0 | < 0:2.34-28.el9_0
- redhat•glibc-common
< 0:2.34-28.el9_0
- redhat•glibc-common-debuginfo
< 0:2.34-28.el9_0 | < 0:2.34-28.el9_0 | < 0:2.34-28.el9_0
- redhat•glibc-debuginfo
< 0:2.34-28.el9_0 | < 0:2.34-28.el9_0 | < 0:2.34-28.el9_0
- redhat•glibc-debugsource
< 0:2.34-28.el9_0 | < 0:2.34-28.el9_0 | < 0:2.34-28.el9_0
- redhat•glibc-devel
< 0:2.34-28.el9_0
- redhat•glibc-doc
< 0:2.34-28.el9_0
- redhat•glibc-gconv-extra
< 0:2.34-28.el9_0
- redhat•glibc-gconv-extra-debuginfo
< 0:2.34-28.el9_0 | < 0:2.34-28.el9_0 | < 0:2.34-28.el9_0
- redhat•glibc-headers
< 0:2.34-28.el9_0
- redhat•glibc-langpack-aa
< 0:2.34-28.el9_0
- redhat•glibc-langpack-af
< 0:2.34-28.el9_0
- redhat•glibc-langpack-agr
< 0:2.34-28.el9_0
- redhat•glibc-langpack-ak
< 0:2.34-28.el9_0
- redhat•glibc-langpack-am
< 0:2.34-28.el9_0
- redhat•glibc-langpack-an
< 0:2.34-28.el9_0
- redhat•glibc-langpack-anp
< 0:2.34-28.el9_0
- redhat•glibc-langpack-ar
< 0:2.34-28.el9_0
- redhat•glibc-langpack-as
< 0:2.34-28.el9_0
- redhat•glibc-langpack-ast
< 0:2.34-28.el9_0
- redhat•glibc-langpack-ayc
< 0:2.34-28.el9_0
- redhat•glibc-langpack-az
< 0:2.34-28.el9_0
- redhat•glibc-langpack-be
< 0:2.34-28.el9_0
- redhat•glibc-langpack-bem
< 0:2.34-28.el9_0
- redhat•glibc-langpack-ber
< 0:2.34-28.el9_0
- redhat•glibc-langpack-bg
< 0:2.34-28.el9_0
- redhat•glibc-langpack-bhb
< 0:2.34-28.el9_0
- redhat•glibc-langpack-bho
< 0:2.34-28.el9_0
- redhat•glibc-langpack-bi
< 0:2.34-28.el9_0
- redhat•glibc-langpack-bn
< 0:2.34-28.el9_0
- redhat•glibc-langpack-bo
< 0:2.34-28.el9_0
- redhat•glibc-langpack-br
< 0:2.34-28.el9_0
- redhat•glibc-langpack-brx
< 0:2.34-28.el9_0
- redhat•glibc-langpack-bs
< 0:2.34-28.el9_0
- redhat•glibc-langpack-byn
< 0:2.34-28.el9_0
- redhat•glibc-langpack-ca
< 0:2.34-28.el9_0
- redhat•glibc-langpack-ce
< 0:2.34-28.el9_0
- redhat•glibc-langpack-chr
< 0:2.34-28.el9_0
- redhat•glibc-langpack-ckb
< 0:2.34-28.el9_0
- redhat•glibc-langpack-cmn
< 0:2.34-28.el9_0
- redhat•glibc-langpack-crh
< 0:2.34-28.el9_0
- redhat•glibc-langpack-cs
< 0:2.34-28.el9_0
Showing first 50 affected entries in server-rendered view.
References (30)
- https://sourceware.org/bugzilla/show_bug.cgi?id=28768
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://security.gentoo.org/glsa/202208-24
- https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
- https://security-tracker.debian.org/tracker/CVE-2022-23218
- https://access.redhat.com/errata/RHBA-2022:3917
- https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.0_release_notes/index
- https://bugzilla.redhat.com/show_bug.cgi?id=1988382
- https://bugzilla.redhat.com/show_bug.cgi?id=2003135
- https://bugzilla.redhat.com/show_bug.cgi?id=2007339
- https://bugzilla.redhat.com/show_bug.cgi?id=2007417
- https://bugzilla.redhat.com/show_bug.cgi?id=2012169
- https://bugzilla.redhat.com/show_bug.cgi?id=2020597
- https://bugzilla.redhat.com/show_bug.cgi?id=2023422
- https://bugzilla.redhat.com/show_bug.cgi?id=2024347
- https://bugzilla.redhat.com/show_bug.cgi?id=2026716
- https://bugzilla.redhat.com/show_bug.cgi?id=2027789
- https://bugzilla.redhat.com/show_bug.cgi?id=2029410
- https://bugzilla.redhat.com/show_bug.cgi?id=2032647
- https://bugzilla.redhat.com/show_bug.cgi?id=2033649
- https://bugzilla.redhat.com/show_bug.cgi?id=2037056
- https://bugzilla.redhat.com/show_bug.cgi?id=2040657
- https://bugzilla.redhat.com/show_bug.cgi?id=2058224
- https://bugzilla.redhat.com/show_bug.cgi?id=2058230
- https://bugzilla.redhat.com/show_bug.cgi?id=2063247
- https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhba-2022_3917.json
- https://access.redhat.com/security/cve/CVE-2022-23218
- https://bugzilla.redhat.com/show_bug.cgi?id=2042013
- https://www.cve.org/CVERecord?id=CVE-2022-23218
- https://nvd.nist.gov/vuln/detail/CVE-2022-23218