CVE-2022-46149 Cap'n Proto vulnerable to out-of-bounds read due to logic error handling list-of-list.
Attackers can cause denial of service or read memory by sending malicious messages to applications using Cap'n Proto.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-46149?
CVE-2022-46149 is a medium-severity memory corruption vulnerability in Fedoraproject Fedora, published on 30 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cap'n Proto is a data interchange format and remote procedure call (RPC) system. Cap'n Proro prior to versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3, as well as versions of Cap'n Proto's Rust implementation prior to 0.13.7, 0.14.11, and 0.15.2 are vulnerable to out-of-bounds read due to logic error handling list-of-list. This issue may lead someone to remotely segfault a peer by sending it a malicious message, if the victim performs certain actions on a list-of-pointer type. Exfiltration of memory is possible if the victim performs additional certain actions on a list-of-pointer type. To be vulnerable, an application must perform a specific sequence of actions, described in the GitHub Security Advisory. The bug is present in inlined code, therefore the fix will require rebuilding dependent applications. Cap'n Proto has C++ fixes available in versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3. The `capnp` Rust crate has fixes available in versions 0.13.7, 0.14.11, and 0.15.2.
Weakness: CWE-125
Which versions are affected by CVE-2022-46149?
7 open source packages ship an affected version, including capnp. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
capnp crates.io | All versions | 0.13.7 |
capnp crates.io | All versions | 0.13.7 |
capnp crates.io | From 0.0.0-0 | 0.13.7, 0.14.11, 0.15.2 |
capnp crates.io | From 0.14.0 | 0.14.11 |
capnp crates.io | From 0.14.0 | 0.14.11 |
capnp crates.io | From 0.15.0 | 0.15.2 |
1 more packages
capnp crates.io | From 0.15.0 | 0.15.2 |
Linux distribution packages (5)
conmon-rs Red Hat:openshift:4.12::el8 | All versions | 0:0.5.1-3.rhaos4.12.git.el8 |
conmon-rs Red Hat:openshift:4.12::el9 | All versions | 0:0.5.1-3.rhaos4.12.git.el9 |
capnproto SUSE:Linux Enterprise Module for Desktop Applications 15 SP4 | All versions | 0.9.1-150400.3.4.1 |
capnproto openSUSE:Leap 15.4 | All versions | 0.9.1-150400.3.4.1 |
python-pycapnp openSUSE:Tumbleweed | All versions | 2.0.0-2.5 |
Products include Capnproto Capnp, Capnproto Capnproto, Fedoraproject Fedora.
How do I fix CVE-2022-46149?
Upgrade capnp to a fixed version for your release line: 0.13.7, 0.14.11 or 0.15.2.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-46149 being exploited?
There is no known exploitation of CVE-2022-46149 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-46149, GHSA-qqff-4vw4-f6hx, JLSEC-2026-1268, RHSA-2023:1408, RUSTSEC-2022-0068, SUSE-SU-2022:4478-1 and 4 more.