CVE-2022-38178: debian debian_linux
CVSS: 7.5v3.1HighModified
AliasesALPINE-CVE-2022-38178UBUNTU-CVE-2022-38178DEBIAN-CVE-2022-38178CGA-gxc9-fj7x-p4f7CGA-h29r-r59w-3cqc
Published 21-09-2022Last modified 28-05-2025
Vulnerability summary
CVE-2022-38178 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 3.00% chance of exploitation in the next 30 days, higher than 87.1% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
3.00%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 17 · Related 8Timeline
- 21-09-2022PublishedVulnerability first disclosed.
- 28-05-2025Last modifiedVulnerability information updated.
Description
By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 7 agree
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
3.00%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
+0.02 pp
From 2.98% on 18-09-2026
18-09-202618-10-2026
EPSS score3.00%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- bind9< 1:9.18.7-1
- debian_linuxEOL11.0
Isc2 products
- bind≥ 9.9.12, ≤ 9.9.13 | ≥ 9.10.7, ≤ 9.10.8 | ≥ 9.11.3, ≤ 9.16.32 | 9.11.3:s1 | 9.11.3:s4 | 9.11.5:s3 | 9.11.5:s5 | 9.11.5:s6 | 9.11.6:s1 | 9.11.7:s1 | 9.11.8:s1 | 9.11.12:s1 | 9.11.14-s1 | 9.11.19-s1 | 9.11.21:s1 | 9.11.27:s1 | 9.11.29:s1 | 9.11.35:s1 | 9.11.37:s1 | 9.16.8:s1 | 9.16.11:s1 | 9.16.13:s1 | 9.16.21:s1 | 9.16.32:s1
- bind9Open Source Branch 9.9 9.9.12 through versions up to and including 9.9.13 | Open Source Branch 9.10 9.10.7 through versions up to and including 9.10.8 | Open Source Branches 9.11 through 9.16 9.11.3 through versions before 9.16.33 | Open Source Branch 9.18 9.18.0 through versions before 9.18.7 | Supported Preview Branch 9.11-S 9.11.4-S1 through versions up to and including 9.11.37-S1 | Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.33-S1 | Development Branch 9.19 9.19.0 through versions before 9.19.5
Alpine1 product
- bind≥ 9.9.12, < 9.16.33-r0 | ≥ 9.9.12, < 9.18.7-r0
Chainguard1 product
- bindAll versions (No fix recorded)
Fedoraproject1 product
- fedoraEOL35 | 36 | 37
Netapp1 product
Ubuntu1 product
- bind9< 1:9.11.3+dfsg-1ubuntu1.18 | < 1:9.16.1-0ubuntu2.11 | < 1:9.18.1-1ubuntu1.2
Wolfi1 product
- bindAll versions (No fix recorded)
8 vendors · 10 products
