CVE-2022-40320 Memory corruption in n/a
A heap-based buffer over-read in libConfuse allows attackers to cause denial of service or disclose sensitive memory contents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-40320?
CVE-2022-40320 is a high-severity memory corruption vulnerability in Fedoraproject Fedora, published on 9 Sep 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read.
Weakness: CWE-125
Which versions are affected by CVE-2022-40320?
It affects 2 products.
Linux distribution packages (12)
libconfuse0 SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | All versions | 2.8-150000.3.3.1 |
libconfuse0 SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 2.8-150000.3.3.1 |
libconfuse0 SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS | All versions | 2.8-150000.3.3.1 |
libconfuse0 SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 2.8-150000.3.3.1 |
libconfuse0 SUSE:Linux Enterprise High Performance Computing 15-ESPOS | All versions | 2.8-150000.3.3.1 |
libconfuse0 SUSE:Linux Enterprise High Performance Computing 15-LTSS | All versions | 2.8-150000.3.3.1 |
libconfuse0 SUSE:Linux Enterprise Module for HPC 12 | All versions | 2.8-3.6.1 |
libconfuse0 SUSE:Linux Enterprise Module for HPC 15 SP3 | All versions | 2.8-150000.3.3.1 |
libconfuse0 SUSE:Linux Enterprise Module for Package Hub 15 SP3 | All versions | 2.8-150000.3.3.1 |
libconfuse0 SUSE:Linux Enterprise Module for Package Hub 15 SP4 | All versions | 2.8-150000.3.3.1 |
libconfuse0 openSUSE:Leap 15.3 | All versions | 2.8-150000.3.3.1 |
libconfuse0 openSUSE:Leap 15.4 | All versions | 2.8-150000.3.3.1 |
Products include Fedoraproject Fedora, Libconfuse Project Libconfuse.
How do I fix CVE-2022-40320?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-40320 being exploited?
There is no known exploitation of CVE-2022-40320 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as AZL-10925, AZL-34910, DEBIAN-CVE-2022-40320, GHSA-4f2q-2458-j6j8, MGASA-2022-0387, OESA-2022-1928 and 4 more.