CVE-2022-23218 Memory corruption in n/a
A buffer overflow in glibc's sunrpc module allows attackers to cause denial of service or execute arbitrary code if stack protection is disabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23218?
CVE-2022-23218 is a critical memory corruption vulnerability in Debian Debian Linux, published on 14 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
Weakness: CWE-120
Which versions are affected by CVE-2022-23218?
It affects 4 products.
Products include Debian Debian Linux, Gnu Glibc, Oracle Communications Cloud Native Core Unified Data Repository, Oracle Enterprise Operations Monitor.
How do I fix CVE-2022-23218?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-23218 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-23218 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-7486, DEBIAN-CVE-2022-23218, GHSA-8g8v-256r-57v7, UBUNTU-CVE-2022-23218.