Buffer Overflow Vulnerability in GNU C Library's sunrpc Module by Oracle
CVE-2022-23218

9.8CRITICAL

Key Information:

Vendor

Gnu
Status
Glibc
Vendor
CVE Published:
14 January 2022

What is CVE-2022-23218?

The GNU C Library (glibc) contains a vulnerability in the deprecated svcunix_create function within the sunrpc module. This issue arises due to the function's failure to validate the length of the path argument, leading to a potential buffer overflow. This flaw poses a significant risk of denial of service and can enable arbitrary code execution if the application is not built with a stack protector. As such, users and developers should prioritize updating to address this vulnerability and mitigate associated threats.

References

https://sourceware.org/bugzilla/show_bug.cgi?id=28768
https://www.oracle.com/security-alerts/cpujul2022.html
https://security.gentoo.org/glsa/202208-24
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.