CVE-2022-2526 Use after free in systemd-resolved

What is CVE-2022-2526?

CVE-2022-2526 is a critical use after free vulnerability in Netapp Active Iq Unified Manager, published on 9 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later.

Weakness: CWE-416

Which versions are affected by CVE-2022-2526?

It affects 6 products.

Products include Netapp Active Iq Unified Manager, Netapp H300s Firmware, Netapp H410s Firmware, Netapp H500s Firmware, Netapp H700s Firmware, Systemd Project Systemd.

How do I fix CVE-2022-2526?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2022-2526 being exploited?

There is no known exploitation of CVE-2022-2526 in the wild and no public exploit code.

Other vulnerabilities in Netapp Active Iq Unified Manager

• CVE-2022-31692 Spring Security authorization rules can be bypassed via forward or include dispatcher types Critical 9.8
• CVE-2022-22978 Authorization bypass in Spring Security Critical 9.8
• CVE-2021-22931 Code injection in Node Critical 9.8
• CVE-2018-2938 Code injection in Java Critical 9.0
• CVE-2018-2941 Code injection in Java High 8.3

All Netapp Active Iq Unified Manager vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALSA-2022:6206, CLSA-2022-1663183381, CLSA-2022-1663184219, DEBIAN-CVE-2022-2526, GHSA-f4r4-2gxf-88xj, RHSA-2022:6160 and 8 more.