SUSE update for rsyslog

1) Heap-based buffer overflow

EUVDB-ID: #VU62830

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-24903

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service or potentially execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when parsing data in imtcp, imptcp, imgssapi, and imhttp modules used for TCP syslog reception. A remote attacker can pass specially crafted data to the application, trigger heap-based buffer overflow and cause a denial of service or potentially execute arbitrary code on the target system.

Successful exploitation of this vulnerability is possible if the attacker is able to directly send specially crafted messages to the rsyslog daemon or by injecting specially crafted data into log files. Vulnerability exploitation in the second scenario requires that the rsyslog client supports octet-counted framing, which is not a default configuration.

Mitigation

Update the affected package rsyslog to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Server: 15-SP2-BCL - 15-SP3-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP2-ESPOS - 15-SP3-LTSS

SUSE Enterprise Storage: 7.1

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Server for SAP: 15-SP2

SUSE Linux Enterprise Desktop: 15-SP3

openSUSE Leap: 15.3

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Module for Basesystem: 15-SP3

SUSE Linux Enterprise Module for Server Applications: 15-SP3

rsyslog-module-udpspoof-debuginfo: before 8.2106.0-150200.4.26.1

rsyslog-module-udpspoof: before 8.2106.0-150200.4.26.1

rsyslog-module-snmp-debuginfo: before 8.2106.0-150200.4.26.1

rsyslog-module-snmp: before 8.2106.0-150200.4.26.1

rsyslog-module-relp-debuginfo: before 8.2106.0-150200.4.26.1

rsyslog-module-relp: before 8.2106.0-150200.4.26.1

rsyslog-module-pgsql-debuginfo: before 8.2106.0-150200.4.26.1

rsyslog-module-pgsql: before 8.2106.0-150200.4.26.1

rsyslog-module-ossl-debuginfo: before 8.2106.0-150200.4.26.1

rsyslog-module-ossl: before 8.2106.0-150200.4.26.1

rsyslog-module-omtcl-debuginfo: before 8.2106.0-150200.4.26.1

rsyslog-module-omtcl: before 8.2106.0-150200.4.26.1

rsyslog-module-omhttpfs-debuginfo: before 8.2106.0-150200.4.26.1

rsyslog-module-omhttpfs: before 8.2106.0-150200.4.26.1

rsyslog-module-omamqp1-debuginfo: before 8.2106.0-150200.4.26.1

rsyslog-module-omamqp1: before 8.2106.0-150200.4.26.1

rsyslog-module-mysql-debuginfo: before 8.2106.0-150200.4.26.1

rsyslog-module-mysql: before 8.2106.0-150200.4.26.1

rsyslog-module-mmnormalize-debuginfo: before 8.2106.0-150200.4.26.1

rsyslog-module-mmnormalize: before 8.2106.0-150200.4.26.1

rsyslog-module-gtls-debuginfo: before 8.2106.0-150200.4.26.1

rsyslog-module-gtls: before 8.2106.0-150200.4.26.1

rsyslog-module-gssapi-debuginfo: before 8.2106.0-150200.4.26.1

rsyslog-module-gssapi: before 8.2106.0-150200.4.26.1

rsyslog-module-gcrypt-debuginfo: before 8.2106.0-150200.4.26.1

rsyslog-module-gcrypt: before 8.2106.0-150200.4.26.1

rsyslog-module-elasticsearch-debuginfo: before 8.2106.0-150200.4.26.1

rsyslog-module-elasticsearch: before 8.2106.0-150200.4.26.1

rsyslog-module-dbi-debuginfo: before 8.2106.0-150200.4.26.1

rsyslog-module-dbi: before 8.2106.0-150200.4.26.1

rsyslog-doc: before 8.2106.0-150200.4.26.1

rsyslog-diag-tools-debuginfo: before 8.2106.0-150200.4.26.1

rsyslog-diag-tools: before 8.2106.0-150200.4.26.1

rsyslog-debugsource: before 8.2106.0-150200.4.26.1

rsyslog-debuginfo: before 8.2106.0-150200.4.26.1

rsyslog: before 8.2106.0-150200.4.26.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221583-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.