CVE-2022-23219 Memory corruption in n/a
A buffer overflow in glibc's sunrpc module allows attackers to cause denial of service or execute arbitrary code via a crafted hostname argument.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23219?
CVE-2022-23219 is a critical memory corruption vulnerability in Debian Debian Linux, published on 14 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
Weakness: CWE-120
Which versions are affected by CVE-2022-23219?
It affects 8 products.
Products include Debian Debian Linux, Gnu Glibc, Oracle Communications Cloud Native Core Binding Support Function, Oracle Communications Cloud Native Core Network Function Cloud Native Environment, Oracle Communications Cloud Native Core Network Repository Function, Oracle Communications Cloud Native Core Security Edge Protection Proxy and 2 more.
How do I fix CVE-2022-23219?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-23219 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-23219 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-7533, DEBIAN-CVE-2022-23219, GHSA-fhxm-4mc9-6jf5, UBUNTU-CVE-2022-23219.