CVE-2022-0563CWE-209

CVE-2022-0563

Medium · published February 22, 2022

CVSS v3.1
5.5
EPSS
0%
Percentile
36.2
In the wild
Unconfirmed
What it is

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00430 · 36.2th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2022-02-22T00:15Z
Affected products (2)
ProductVersionsFixed in
kernel/util-linux< 2.37.42.37.4
netapp/ontap_select_deploy_administration_utilityall versions—
References (7)
https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u · [email protected]https://security.gentoo.org/glsa/202401-08 · [email protected]https://security.netapp.com/advisory/ntap-20220331-0002/ · [email protected]https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202401-08 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20220331-0002/ · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 21 FEB 00:00Z
    A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support
    cvelistv5