sysstat up to 12.7.0 on 32-bit sa_common.c allocate_structures buffer overflow

Summaryinfo

A vulnerability, which was classified as critical, has been found in sysstat up to 12.7.0 on 32-bit. This affects the function allocate_structures of the file sa_common.c. This manipulation causes buffer overflow. This vulnerability appears as CVE-2022-39377. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in sysstat up to 12.7.0 on 32-bit. Affected by this vulnerability is the function allocate_structures of the file sa_common.c. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_structures contains a size_t overflow in sa_common.c. The allocate_structures function insufficiently checks bounds before arithmetic multiplication, allowing for an overflow in the size allocated for the buffer representing system activities. This issue may lead to Remote Code Execution (RCE). This issue has been patched in version 12.7.1.

The weakness was presented 11/09/2022 as GHSA-q8r6-g56f-9w7x. The advisory is shared at github.com. This vulnerability is known as CVE-2022-39377 since 09/02/2022. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 211432 (Fedora 37 : sysstat (2022-9f3af921a5)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 12.7.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (211432) and CERT Bund (WID-SEC-2023-1185). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• Gentoo Linux
• SUSE openSUSE
• Red Hat OpenShift
• RESF Rocky Linux

Productinfo

Name

• sysstat

Version

• 12.0
• 12.1
• 12.2
• 12.3
• 12.4
• 12.5
• 12.6
• 12.7.0

Website

• Product: https://github.com/sysstat/sysstat/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion