CVE-2022-23218 — Classic Buffer Overflow in Glibc
Severity
9.8CRITICALNVD
EPSS
0.4%
top 40.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 14
Latest updateOct 15
Description
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages4 packages
Also affects: Debian Linux 10.0
Patches
🔴Vulnerability Details
4GHSA▶
GHSA-8g8v-256r-57v7: The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2↗2022-01-15
CVEList▶
CVE-2022-23218: The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2↗2022-01-14
OSV▶
CVE-2022-23218: The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2↗2022-01-14
📋Vendor Advisories
6Microsoft▶
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length which may re↗2022-01-11