CVE-2022-43995 Memory corruption in n/a
Local attackers can trigger a heap-based buffer over-read in Sudo when using the crypt() password backend with short passwords, potentially leaking memory or causing crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-43995?
CVE-2022-43995 is a high-severity memory corruption vulnerability in n/a, published on 2 Nov 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer. The impact could vary depending on the system libraries, compiler, and processor architecture.
Weakness: CWE-125
Which versions are affected by CVE-2022-43995?
It affects 1 product.
Linux distribution packages (37)
sudo SUSE:Enterprise Storage 6 | All versions | 1.8.27-150000.4.30.1 |
sudo SUSE:Enterprise Storage 7 | All versions | 1.8.27-150000.4.30.1 |
sudo SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | All versions | 1.8.27-150000.4.30.1 |
sudo SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 1.8.27-150000.4.30.1 |
sudo SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS | All versions | 1.8.27-150000.4.30.1 |
sudo SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 1.8.27-150000.4.30.1 |
sudo SUSE:Linux Enterprise High Performance Computing 15-ESPOS | All versions | 1.8.27-150000.4.30.1 |
sudo SUSE:Linux Enterprise High Performance Computing 15-LTSS | All versions | 1.8.27-150000.4.30.1 |
sudo SUSE:Linux Enterprise Micro 5.1 | All versions | 1.9.5p2-150300.3.13.1 |
sudo SUSE:Linux Enterprise Micro 5.2 | All versions | 1.9.5p2-150300.3.13.1 |
sudo SUSE:Linux Enterprise Micro 5.3 | All versions | 1.9.9-150400.4.6.1 |
sudo SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 1.9.5p2-150300.3.13.1 |
sudo SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 1.9.9-150400.4.6.1 |
sudo SUSE:Linux Enterprise Server 12 SP2-BCL | All versions | 1.8.10p3-10.38.1 |
sudo SUSE:Linux Enterprise Server 12 SP3-BCL | All versions | 1.8.20p2-3.33.1 |
sudo SUSE:Linux Enterprise Server 12 SP4-LTSS | All versions | 1.8.20p2-3.33.1 |
sudo SUSE:Linux Enterprise Server 12 SP5 | All versions | 1.8.27-4.30.1 |
sudo SUSE:Linux Enterprise Server 15 SP1-BCL | All versions | 1.8.27-150000.4.30.1 |
sudo SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 1.8.27-150000.4.30.1 |
sudo SUSE:Linux Enterprise Server 15 SP2-BCL | All versions | 1.8.27-150000.4.30.1 |
sudo SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 1.8.27-150000.4.30.1 |
sudo SUSE:Linux Enterprise Server 15-LTSS | All versions | 1.8.27-150000.4.30.1 |
sudo SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 1.8.20p2-3.33.1 |
sudo SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 1.8.27-4.30.1 |
sudo SUSE:Linux Enterprise Server for SAP Applications 15 | All versions | 1.8.27-150000.4.30.1 |
sudo SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 1.8.27-150000.4.30.1 |
sudo SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 1.8.27-150000.4.30.1 |
sudo SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 1.8.27-4.30.1 |
sudo SUSE:Manager Proxy 4.1 | All versions | 1.8.27-150000.4.30.1 |
sudo SUSE:Manager Retail Branch Server 4.1 | All versions | 1.8.27-150000.4.30.1 |
sudo SUSE:Manager Server 4.1 | All versions | 1.8.27-150000.4.30.1 |
sudo SUSE:OpenStack Cloud 9 | All versions | 1.8.20p2-3.33.1 |
sudo SUSE:OpenStack Cloud Crowbar 9 | All versions | 1.8.20p2-3.33.1 |
sudo openSUSE:Leap 15.3 | All versions | 1.9.5p2-150300.3.13.1 |
sudo openSUSE:Leap 15.4 | All versions | 1.9.9-150400.4.6.1 |
sudo openSUSE:Leap Micro 5.2 | All versions | 1.9.5p2-150300.3.13.1 |
sudo openSUSE:Tumbleweed | All versions | 1.9.12-3.1 |
Products include Sudo Project Sudo.
How do I fix CVE-2022-43995?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-43995 being exploited?
There is no known exploitation of CVE-2022-43995 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as ALPINE-CVE-2022-43995, AZL-11400, DEBIAN-CVE-2022-43995, GHSA-3r97-xp9v-83jf, MGASA-2022-0426, OESA-2022-2079 and 7 more.