GNU C Library up to 2.34 sunrpc svcunix_create path buffer overflow

Summaryinfo

A vulnerability, which was classified as critical, has been found in GNU C Library up to 2.34. This issue affects the function svcunix_create of the component sunrpc Module. Performing a manipulation of the argument path results in buffer overflow. This vulnerability is cataloged as CVE-2022-23218. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as critical has been found in GNU C Library up to 2.34 (Software Library). This affects the function svcunix_create of the component sunrpc Module. The manipulation of the argument path with an unknown input leads to a buffer overflow vulnerability. CWE is classifying the issue as CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was shared 01/14/2022. It is possible to read the advisory at sourceware.org. This vulnerability is uniquely identified as CVE-2022-23218 since 01/14/2022. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 239848 (TencentOS Server 3: glibc (TSSA-2022:0203)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (239848). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Software Library

Vendor

• GNU

Name

• C Library

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33
• 2.34

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion