CVE-2022-24903: debian debian_linux Classic Buffer Overflow

CVSS: 8.1v3.1HighModified

AliasesALPINE-CVE-2022-24903MGASA-2022-0165SUSE-SU-2022:1583-1+17 more

Published 05-05-2022Last modified 23-04-2025

Vulnerability summary

CVE-2022-24903 is a high (CVSS 8.1) Classic Buffer Overflow vulnerability in debian debian_linux. EPSS estimates a 3.95% chance of exploitation in the next 30 days, higher than 90.2% of scored vulnerabilities.

Overall risk

33/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.1/10

010

High · v3.1 (CVE.org)

EPSS score

3.95%

0%100%

Low · +0.02 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3

DLA-3016-1 RHSA-2022:4896 RHSA-2022:5439

Timeline

05-05-2022
PublishedVulnerability first disclosed.
23-04-2025
Last modifiedVulnerability information updated.

Description

Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability can not be used for remote code execution. But there may still be a slight chance for experts to do that. The bug occurs when the octet count is read. While there is a check for the maximum number of octets, digits are written to a heap buffer even when the octet count is over the maximum, This can be used to overrun the memory buffer. However, once the sequence of digits stop, no additional characters can be added to the buffer. In our opinion, this makes remote exploits impossible or at least highly complex. Octet-counted framing is one of two potential framing modes. It is relatively uncommon, but enabled by default on receivers. Modules `imtcp`, `imptcp`, `imgssapi`, and `imhttp` are used for regular syslog message reception. It is best practice not to directly expose them to the public. When this practice is followed, the risk is considerably lower. Module `imdiag` is a diagnostics module primarily intended for testbench runs. We do not expect it to be present on any production installation. Octet-counted framing is not very common. Usually, it needs to be specifically enabled at senders. If users do not need it, they can turn it off for the most important modules. This will mitigate the vulnerability.

CVSS metrics

7 scores · 6 sources · 2 versions

v3.18.1v2.06.8

EPSS trend

Probability

3.95%

Chance of exploitation in the next 30 days

Percentile

90%

Versus all other CVEs

30-day change

+0.02 pp

From 3.93% on 19-09-2026

19-09-202619-10-2026

EPSS score

3.95%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat51 products

rsyslog< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3 | < 0:8.24.0-57.el7_9.3 | < 0:5.8.10-12.el6_10.1
rsyslog-crypto< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3 | < 0:8.24.0-57.el7_9.3
rsyslog-crypto-debuginfo< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3
rsyslog-debuginfo< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3 | < 0:8.24.0-57.el7_9.3 | < 0:5.8.10-12.el6_10.1
rsyslog-debugsource< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3

rsyslog-doc< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3 | < 0:8.24.0-57.el7_9.3
rsyslog-elasticsearch< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3 | < 0:8.24.0-57.el7_9.3
rsyslog-elasticsearch-debuginfo< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3
rsyslog-gnutls< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3 | < 0:8.24.0-57.el7_9.3 | < 0:5.8.10-12.el6_10.1
rsyslog-gnutls-debuginfo< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3
rsyslog-gssapi< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3 | < 0:8.24.0-57.el7_9.3 | < 0:5.8.10-12.el6_10.1
rsyslog-gssapi-debuginfo< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3
rsyslog-kafka< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3 | < 0:8.24.0-57.el7_9.3
rsyslog-kafka-debuginfo< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3
rsyslog-libdbi< 0:8.24.0-57.el7_9.3
rsyslog-logrotate< 0:8.2102.0-101.el9_0.1
rsyslog-mmaudit< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3 | < 0:8.24.0-57.el7_9.3
rsyslog-mmaudit-debuginfo< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3
rsyslog-mmfields< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1
rsyslog-mmfields-debuginfo< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1
rsyslog-mmjsonparse< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3 | < 0:8.24.0-57.el7_9.3
rsyslog-mmjsonparse-debuginfo< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3
rsyslog-mmkubernetes< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3 | < 0:8.24.0-57.el7_9.3
rsyslog-mmkubernetes-debuginfo< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3
rsyslog-mmnormalize< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3 | < 0:8.24.0-57.el7_9.3
rsyslog-mmnormalize-debuginfo< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3
rsyslog-mmsnmptrapd< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3 | < 0:8.24.0-57.el7_9.3
rsyslog-mmsnmptrapd-debuginfo< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3
rsyslog-mysql< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3 | < 0:8.24.0-57.el7_9.3 | < 0:5.8.10-12.el6_10.1
rsyslog-mysql-debuginfo< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3
rsyslog-omamqp1< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-7.el8_4.3
rsyslog-omamqp1-debuginfo< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-7.el8_4.3
rsyslog-openssl< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1
rsyslog-openssl-debuginfo< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1
rsyslog-pgsql< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3 | < 0:8.24.0-57.el7_9.3 | < 0:5.8.10-12.el6_10.1
rsyslog-pgsql-debuginfo< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3
rsyslog-relp< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3 | < 0:8.24.0-57.el7_9.3 | < 0:5.8.10-12.el6_10.1
rsyslog-relp-debuginfo< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3
rsyslog-snmp< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3 | < 0:8.24.0-57.el7_9.3 | < 0:5.8.10-12.el6_10.1
rsyslog-snmp-debuginfo< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-3.el8_2.1 | < 0:8.37.0-13.el8_1.1 | < 0:8.1911.0-7.el8_4.3
rsyslog-udpspoof< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-7.el8_4.3 | < 0:8.24.0-57.el7_9.3
rsyslog-udpspoof-debuginfo< 0:8.2102.0-101.el9_0.1 | < 0:8.2102.0-7.el8_6.1 | < 0:8.1911.0-7.el8_4.3
rsyslog7< 0:7.4.10-7.el6_10.1
rsyslog7-debuginfo< 0:7.4.10-7.el6_10.1
rsyslog7-elasticsearch< 0:7.4.10-7.el6_10.1
rsyslog7-gnutls< 0:7.4.10-7.el6_10.1
rsyslog7-gssapi< 0:7.4.10-7.el6_10.1
rsyslog7-mysql< 0:7.4.10-7.el6_10.1
rsyslog7-pgsql< 0:7.4.10-7.el6_10.1
rsyslog7-relp< 0:7.4.10-7.el6_10.1
rsyslog7-snmp< 0:7.4.10-7.el6_10.1

Show all 51

Suse35 products

rsyslog&distro=HPE Helion OpenStack 8< 8.24.0-3.58.2
rsyslog&distro=SUSE Enterprise Storage 6< 8.33.1-150000.3.37.1
rsyslog&distro=SUSE Enterprise Storage 7< 8.2106.0-150200.4.26.1
rsyslog&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 8.33.1-150000.3.37.1
rsyslog&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 8.33.1-150000.3.37.1

rsyslog&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS< 8.2106.0-150200.4.26.1
rsyslog&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 8.2106.0-150200.4.26.1
rsyslog&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 8.33.1-150000.3.37.1
rsyslog&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 8.33.1-150000.3.37.1
rsyslog&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3< 8.2106.0-150200.4.26.1
rsyslog&distro=SUSE Linux Enterprise Module for Server Applications 15 SP3< 8.2106.0-150200.4.26.1
rsyslog&distro=SUSE Linux Enterprise Real Time 15 SP2< 8.2106.0-150200.4.26.1
rsyslog&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 8.4.0-18.16.1
rsyslog&distro=SUSE Linux Enterprise Server 12 SP3-BCL< 8.24.0-3.58.2
rsyslog&distro=SUSE Linux Enterprise Server 12 SP3-LTSS< 8.24.0-3.58.2
rsyslog&distro=SUSE Linux Enterprise Server 12 SP4-LTSS< 8.24.0-3.58.2
rsyslog&distro=SUSE Linux Enterprise Server 12 SP5< 8.2106.0-8.5.2
rsyslog&distro=SUSE Linux Enterprise Server 15 SP1-BCL< 8.33.1-150000.3.37.1
rsyslog&distro=SUSE Linux Enterprise Server 15 SP1-LTSS< 8.33.1-150000.3.37.1
rsyslog&distro=SUSE Linux Enterprise Server 15 SP2-BCL< 8.2106.0-150200.4.26.1
rsyslog&distro=SUSE Linux Enterprise Server 15 SP2-LTSS< 8.2106.0-150200.4.26.1
rsyslog&distro=SUSE Linux Enterprise Server 15-LTSS< 8.33.1-150000.3.37.1
rsyslog&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3< 8.24.0-3.58.2
rsyslog&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4< 8.24.0-3.58.2
rsyslog&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 8.2106.0-8.5.2
rsyslog&distro=SUSE Linux Enterprise Server for SAP Applications 15< 8.33.1-150000.3.37.1
rsyslog&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1< 8.33.1-150000.3.37.1
rsyslog&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP2< 8.2106.0-150200.4.26.1
rsyslog&distro=SUSE Manager Proxy 4.1< 8.2106.0-150200.4.26.1
rsyslog&distro=SUSE Manager Retail Branch Server 4.1< 8.2106.0-150200.4.26.1
rsyslog&distro=SUSE Manager Server 4.1< 8.2106.0-150200.4.26.1
rsyslog&distro=SUSE OpenStack Cloud 8< 8.24.0-3.58.2
rsyslog&distro=SUSE OpenStack Cloud 9< 8.24.0-3.58.2
rsyslog&distro=SUSE OpenStack Cloud Crowbar 8< 8.24.0-3.58.2
rsyslog&distro=SUSE OpenStack Cloud Crowbar 9< 8.24.0-3.58.2

Show all 35

Debian2 products

rsyslog< 8.1901.0-1+deb10u2 | < 8.2102.0-2+deb11u1 | < 8.2204.1-1
debian_linuxEOL9.0 | 10.0 | 11.0

Opensuse2 products

rsyslog&distro=openSUSE Leap 15.3< 8.2106.0-150200.4.26.1
rsyslog&distro=openSUSE Tumbleweed< 8.2204.1-1.1

Alpine1 product

rsyslog< 8.2004.0-r2 | < 8.2012.0-r3 | < 8.2108.0-r2 | < 8.2204.1-r0

Fedoraproject1 product

fedoraEOL35

Mageia1 product

rsyslog< 8.2204.1-1.mga8

Netapp1 product

active_iq_unified_managerna

Rsyslog1 product

rsyslog< 8.2204.1

Ubuntu1 product

rsyslogAll versions (No fix recorded) | < 8.32.0-1ubuntu4.2 | < 8.2001.0-1ubuntu1.3 | < 8.2112.0-2ubuntu2.2 | < 8.16.0-1ubuntu3.1+esm2

10 vendors · 96 products

References

50 links

github.com/rsyslog/rsyslog/security/advisories/GHSA-ggw7-xr6h-mmr8AdvisoryARTICLEThird Party Advisory
github.com/rsyslog/rsyslog/commit/f211042ecbb472f9d8beb4678a65d272b6f07705PatchThird Party Advisory
lists.fedoraproject.org/archives/…Vendor Advisory
lists.debian.org/debian-lts-announce/2022/05/msg00028.htmlMailing ListThird Party Advisory
www.debian.org/security/2022/dsa-5150Vendor AdvisoryThird Party Advisory
security.netapp.com/advisory/ntap-20221111-0002/Third Party Advisory
security.alpinelinux.org/vuln/CVE-2022-24903Advisory
advisories.mageia.org/MGASA-2022-0165.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=30383REPORT
www.suse.com/support/update/announcement/2022/suse-su-20221583-1/Advisory

Show all 50 references

bugzilla.suse.com/1199061REPORT
www.suse.com/security/cve/CVE-2022-24903WEB
www.suse.com/support/update/announcement/2022/suse-su-20221817-1/Advisory
www.suse.com/support/update/announcement/2022/suse-su-20222314-1/Advisory
bugzilla.suse.com/1051798REPORT
bugzilla.suse.com/1068678REPORT
bugzilla.suse.com/1080238REPORT
bugzilla.suse.com/1082318REPORT
bugzilla.suse.com/1101642REPORT
bugzilla.suse.com/1110456REPORT
bugzilla.suse.com/1160414REPORT
bugzilla.suse.com/1178288REPORT
bugzilla.suse.com/1178490REPORT
bugzilla.suse.com/1182653REPORT
bugzilla.suse.com/1188039REPORT
www.suse.com/support/update/announcement/2022/suse-su-20222331-1/Advisory
www.suse.com/support/update/announcement/2022/suse-su-20222333-1/Advisory
access.redhat.com/errata/RHSA-2022:4795Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2081353REPORT
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4795.jsonAdvisory
access.redhat.com/security/cve/CVE-2022-24903REPORT
www.cve.org/CVERecord?id=CVE-2022-24903AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2022-24903AdvisoryOval
access.redhat.com/errata/RHSA-2022:4799Advisory
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4799.jsonAdvisory
access.redhat.com/errata/RHSA-2022:4800Advisory
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4800.jsonAdvisory
access.redhat.com/errata/RHSA-2022:4801Advisory
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4801.jsonAdvisory
access.redhat.com/errata/RHSA-2022:4802Advisory
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4802.jsonAdvisory
access.redhat.com/errata/RHSA-2022:4803Advisory
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4803.jsonAdvisory
access.redhat.com/errata/RHSA-2022:4808Advisory
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4808.jsonAdvisory
ubuntu.com/security/CVE-2022-24903REPORT
ubuntu.com/security/notices/USN-5404-1Advisory
ubuntu.com/security/notices/USN-5404-2Advisory
security-tracker.debian.org/tracker/CVE-2022-24903Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities