CVE-2022-38177: debian debian_linux
CVSS: 7.5v3.1HighModified
AliasesALPINE-CVE-2022-38177UBUNTU-CVE-2022-38177DEBIAN-CVE-2022-38177CGA-c6cr-95w9-6xr8CGA-gp22-499v-mp5q
Published 21-09-2022Last modified 28-05-2025
Vulnerability summary
CVE-2022-38177 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 3.17% chance of exploitation in the next 30 days, higher than 87.8% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
3.17%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 18 · Related 9Timeline
- 21-09-2022PublishedVulnerability first disclosed.
- 28-05-2025Last modifiedVulnerability information updated.
Description
By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 7 agree
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
3.17%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
+0.02 pp
From 3.15% on 18-09-2026
18-09-202618-10-2026
EPSS score3.17%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- bind9< 1:9.17.20-1
- debian_linuxEOL10.0 | 11.0
Isc2 products
- bind≥ 9.8.4, ≤ 9.16.32 | 9.9.3:s1 | 9.9.12:s1 | 9.9.13:s1 | 9.10.5:s1 | 9.10.7:s1 | 9.11.3:s1 | 9.11.5:s3 | 9.11.5:s5 | 9.11.5:s6 | 9.11.6:s1 | 9.11.7:s1 | 9.11.8:s1 | 9.11.12:s1 | 9.11.14-s1 | 9.11.19-s1 | 9.11.21:s1 | 9.11.27:s1 | 9.11.29:s1 | 9.11.35:s1 | 9.11.37:s1 | 9.16.8:s1 | 9.16.11:s1 | 9.16.13:s1 | 9.16.21:s1 | 9.16.32:s1
- bind9Open Source Branches 9.8 through 9.16 9.8.4 through versions before 9.16.33 | Supported Preview Branches 9.9-S through 9.11-S 9.9.4-S1 through versions up to and including 9.11.37-S1 | Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1
Alpine1 product
- bind≥ 9.8.4, < 9.16.33-r0 | ≥ 9.8.4, < 9.18.7-r0
Chainguard1 product
- bindAll versions (No fix recorded)
Fedoraproject1 product
- fedoraEOL35 | 36 | 37
Netapp1 product
Ubuntu1 product
- bind9< 1:9.9.5.dfsg-3ubuntu0.19+esm7 | < 1:9.10.3.dfsg.P4-8ubuntu1.19+esm3 | < 1:9.11.3+dfsg-1ubuntu1.18 | < 1:9.16.1-0ubuntu2.11
Wolfi1 product
- bindAll versions (No fix recorded)
8 vendors · 10 products
