CVE-2022-1348 Denial of service in logrotate
An unprivileged user can lock the logrotate state file due to world-readable permissions, preventing log rotation and causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-1348?
CVE-2022-1348 is a medium-severity denial of service vulnerability in Fedoraproject Fedora, published on 25 May 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the state file does not exist, it is created with world-readable permission, allowing an unprivileged user to lock the state file, stopping any rotation. This flaw affects logrotate versions before 3.20.0.
Weakness: CWE-732
Which versions are affected by CVE-2022-1348?
It affects 2 products.
Linux distribution packages (8)
logrotate AlmaLinux:9 | All versions | 3.18.0-7.el9 |
logrotate Red Hat:enterprise_linux:9::baseos | All versions | 0:3.18.0-7.el9 |
logrotate-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:3.18.0-7.el9 |
logrotate-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 0:3.18.0-7.el9 |
logrotate Rocky Linux:9 | All versions | 0:3.18.0-7.el9 |
logrotate SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 3.18.1-150400.3.7.1 |
logrotate openSUSE:Leap 15.4 | All versions | 3.18.1-150400.3.7.1 |
logrotate openSUSE:Tumbleweed | All versions | 3.20.1-1.1 |
Products include Fedoraproject Fedora, Logrotate Project Logrotate.
How do I fix CVE-2022-1348?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-1348 being exploited?
There is no known exploitation of CVE-2022-1348 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2022-1348, ALSA-2022:8393, AZL-9845, DEBIAN-CVE-2022-1348, GHSA-4c4j-w8hm-rjgv, MGASA-2022-0217 and 7 more.