CVE-2022-24903 Buffer overflow in TCP syslog server (receiver) components in rsyslog

What is CVE-2022-24903?

CVE-2022-24903 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 5 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability can not be used for remote code execution. But there may still be a slight chance for experts to do that. The bug occurs when the octet count is read. While there is a check for the maximum number of octets, digits are written to a heap buffer even when the octet count is over the maximum, This can be used to overrun the memory buffer. However, once the sequence of digits stop, no additional characters can be added to the buffer. In our opinion, this makes remote exploits impossible or at least highly complex. Octet-counted framing is one of two potential framing modes. It is relatively uncommon, but enabled by default on receivers. Modules `imtcp`, `imptcp`, `imgssapi`, and `imhttp` are used for regular syslog message reception. It is best practice not to directly expose them to the public. When this practice is followed, the risk is considerably lower. Module `imdiag` is a diagnostics module primarily intended for testbench runs. We do not expect it to be present on any production installation. Octet-counted framing is not very common. Usually, it needs to be specifically enabled at senders. If users do not need it, they can turn it off for the most important modules. This will mitigate the vulnerability.

Weakness: CWE-1284, CWE-120

Which versions are affected by CVE-2022-24903?

It affects 4 products.

Products include Debian Debian Linux, Fedoraproject Fedora, Netapp Active Iq Unified Manager, Rsyslog Rsyslog.

How do I fix CVE-2022-24903?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-24903 being exploited?

There is no known exploitation of CVE-2022-24903 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Debian Debian Linux

• CVE-2015-3306 ProFTPD Improper Access Control Exploited Critical 10.0
• CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data Exploited Critical 9.9
• CVE-2026-24061 GNU InetUtils Argument Injection Exploited Critical 9.8
• CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Exploited Critical 9.8
• CVE-2024-9680 Mozilla Firefox Use-After-Free Exploited Critical 9.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2022-24903, ALSA-2022:4799, AZL-9736, CLSA-2022-1652706426, CLSA-2022-1652706523, CLSA-2022-1653917271 and 25 more.