CVE-2022-1117 Security feature bypass in fapolicyd
Attackers can bypass fapolicyd restrictions by exploiting incorrect runtime linker detection, allowing unauthorized application execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-1117?
CVE-2022-1117 is a high-severity vulnerability in fapolicyd, published on 29 Aug 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was found in fapolicyd. The vulnerability occurs due to an assumption on how glibc names the runtime linker, a build time regular expression may not correctly detect the runtime linker. The consequence is that the pattern detection for applications launched by the run time linker may fail to detect the pattern and allow execution.
Weakness: CWE-552
Which versions are affected by CVE-2022-1117?
It affects 1 product.
Linux distribution packages (11)
fapolicyd AlmaLinux:8 | All versions | 1.1-6.el8 |
fapolicyd-selinux AlmaLinux:8 | All versions | 1.1-6.el8 |
fapolicyd Red Hat:enterprise_linux:8::appstream | All versions | 0:1.1-6.el8 |
fapolicyd-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.1-6.el8 |
fapolicyd-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.1-6.el8 |
fapolicyd-selinux Red Hat:enterprise_linux:8::appstream | All versions | 0:1.1-6.el8 |
fapolicyd Red Hat:rhel_eus:8.4::appstream | All versions | 0:1.0.2-6.el8_4.1 |
fapolicyd-debuginfo Red Hat:rhel_eus:8.4::appstream | All versions | 0:1.0.2-6.el8_4.1 |
fapolicyd-debugsource Red Hat:rhel_eus:8.4::appstream | All versions | 0:1.0.2-6.el8_4.1 |
fapolicyd-selinux Red Hat:rhel_eus:8.4::appstream | All versions | 0:1.0.2-6.el8_4.1 |
fapolicyd Rocky Linux:8 | All versions | 0:1.1-6.el8 |
Products include Fapolicyd Project Fapolicyd.
How do I fix CVE-2022-1117?
Apply the vendor's patch.
Is CVE-2022-1117 being exploited?
There is no known exploitation of CVE-2022-1117 in the wild and no public exploit code.
Sources
Also known as ALSA-2022:1898, AZL-10863, GHSA-8m6j-c7jr-pc5f, RHSA-2022:1898, RHSA-2022:4824, RLSA-2022:1898.