CVE-2022-48174 Memory corruption in n/a
A stack overflow in BusyBox ash allows arbitrary code execution, impacting Internet of Vehicles environments and embedded systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-48174?
CVE-2022-48174 is a critical memory corruption vulnerability in Debian Debian Linux, published on 22 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.
Weakness: CWE-787
Which versions are affected by CVE-2022-48174?
It affects 2 products.
Linux distribution packages (25)
busybox Red Hat:rhel_els:6 | All versions | 1:1.15.1-21.el6_10.1 |
busybox-petitboot Red Hat:rhel_els:6 | All versions | 1:1.15.1-21.el6_10.1 |
busybox SUSE:Enterprise Storage 7 | All versions | 1.35.0-150000.4.20.1 |
busybox SUSE:Enterprise Storage 7.1 | All versions | 1.35.0-150000.4.20.1 |
busybox SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 1.35.0-150000.4.20.1 |
busybox SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 1.35.0-150000.4.20.1 |
busybox SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS | All versions | 1.35.0-150000.4.20.1 |
busybox SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 1.35.0-150000.4.20.1 |
busybox SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 1.35.0-150400.3.11.1 |
busybox SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 1.35.0-150500.10.3.3 |
busybox SUSE:Linux Enterprise Server 12 SP5 | All versions | 1.35.0-4.12.1 |
busybox SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 1.35.0-150000.4.20.1 |
busybox SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 1.35.0-150000.4.20.1 |
busybox SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 1.35.0-150000.4.20.1 |
busybox SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 1.35.0-4.12.1 |
busybox SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 1.35.0-150000.4.20.1 |
busybox SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 1.35.0-150000.4.20.1 |
busybox SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 1.35.0-150000.4.20.1 |
busybox SUSE:Manager Proxy 4.2 | All versions | 1.35.0-150000.4.20.1 |
busybox SUSE:Manager Server 4.2 | All versions | 1.35.0-150000.4.20.1 |
busybox openSUSE:Leap 15.4 | All versions | 1.35.0-150400.3.11.1 |
busybox-links openSUSE:Leap 15.4 | All versions | 1.35.0-150400.4.5.1 |
busybox openSUSE:Leap 15.5 | All versions | 1.35.0-150500.10.3.3 |
busybox-links openSUSE:Leap 15.5 | All versions | 1.35.0-150400.4.5.1 |
busybox openSUSE:Tumbleweed | All versions | 1.36.1-2.1 |
Products include Busybox Busybox, Debian Debian Linux.
How do I fix CVE-2022-48174?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-48174 being exploited?
There is no known exploitation of CVE-2022-48174 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2022-48174, AZL-56490, AZL-64326, BELL-CVE-2022-48174, CLEANSTART-2026-ZR79316, CLSA-2023-1693904834 and 17 more.