CVE-2022-45873CWE-400denial-of-service

CVE-2022-45873

Medium · published November 24, 2022

CVSS v3.1
5.5
EPSS
0%
Percentile
17.5
In the wild
Unconfirmed
What it is

systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology is to crash a binary calling the same function recursively, and put it in a deeply nested directory to make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16 is set for the systemd/units/systemd-coredump.socket file.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00266 · 17.5th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2022-11-24T04:15Z
Affected products (4)
ProductVersionsFixed in
systemd_project/systemd≥ 250, ≤ 251—
systemd_project/systemdall versions—
systemd_project/systemdall versions—
fedoraproject/fedoraall versions—
References (9)
https://github.com/systemd/systemd/commit/076b807be472630692c5348c60d0c2b7b28ad437 · [email protected]https://github.com/systemd/systemd/pull/24853#issuecomment-1326561497 · [email protected]https://github.com/systemd/systemd/pull/25055#issuecomment-1313733553 · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MS5N5SLYAHKENLAJWYBDKU55ICU3SVZF/ · [email protected]https://github.com/systemd/systemd/commit/076b807be472630692c5348c60d0c2b7b28ad437 · af854a3a-2127-422b-91ae-364da2661108https://github.com/systemd/systemd/pull/24853#issuecomment-1326561497 · af854a3a-2127-422b-91ae-364da2661108https://github.com/systemd/systemd/pull/25055#issuecomment-1313733553 · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MS5N5SLYAHKENLAJWYBDKU55ICU3SVZF/ · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 23 NOV 00:00Z
    systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace
    cvelistv5