CVE-2022-39046 Information disclosure in n/a
Attackers can read uninitialized heap memory via crafted syslog input, potentially exposing sensitive data in logs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-39046?
CVE-2022-39046 is a high-severity vulnerability in Gnu Glibc, published on 31 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the GNU C Library (glibc) 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitialized memory from the heap and prints it to the target log file, potentially revealing a portion of the contents of the heap.
Weakness: CWE-532
Which versions are affected by CVE-2022-39046?
It affects 7 products.
Linux distribution packages (1)
glibc openSUSE:Tumbleweed | All versions | 2.36-3.1 |
Products include Gnu Glibc, Netapp H300s Firmware, Netapp H410c Firmware, Netapp H410s Firmware, Netapp H500s Firmware, Netapp H700s Firmware and 1 more.
How do I fix CVE-2022-39046?
Apply the vendor's patch.
Is CVE-2022-39046 being exploited?
There is no known exploitation of CVE-2022-39046 in the wild and no public exploit code.
Other vulnerabilities in Gnu Glibc
Sources
Also known as GHSA-f6rj-qrpf-jc34, openSUSE-SU-2024:12316-1.