CVE-2022-4743 Denial of service in SDL2
A memory leak in SDL2's GLES_CreateTexture function allows attackers to cause a denial of service by exhausting system resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-4743?
CVE-2022-4743 is a high-severity denial of service vulnerability in Redhat Enterprise Linux, published on 12 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected.
Weakness: CWE-401
Which versions are affected by CVE-2022-4743?
It affects 2 products.
Linux distribution packages (5)
SDL2 SUSE:Linux Enterprise Module for Desktop Applications 15 SP4 | All versions | 2.0.8-150200.11.9.1 |
SDL2 SUSE:Linux Enterprise Module for Package Hub 15 SP4 | All versions | 2.0.8-150200.11.9.1 |
SDL2 SUSE:Linux Enterprise Real Time 15 SP3 | All versions | 2.0.8-150200.11.9.1 |
SDL2 SUSE:Package Hub 12 | All versions | 2.0.5-10.1 |
SDL2 openSUSE:Leap 15.4 | All versions | 2.0.8-150200.11.9.1 |
Products include Libsdl Simple Directmedia Layer, Redhat Enterprise Linux.
How do I fix CVE-2022-4743?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-4743 being exploited?
There is no known exploitation of CVE-2022-4743 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
Sources
Also known as AZL-43546, AZL-44748, DEBIAN-CVE-2022-4743, DLA-4382-1, GHSA-94g7-4r7x-4rfv, JLSEC-2026-365 and 5 more.