Out-of-bounds read in libconfuse - CVE-2022-40320

Vulnerability identifier: #VU67558

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-40320

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a heap-based buffer over-read within the cfg_tilde_expand() function in confuse.c. A remote attacker can perform a denial of service attack.

libconfuse
Amazon Linux AMI
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Storage
Fedora
SUSE Linux Enterprise Module for HPC
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server
openSUSE Leap
openEuler
SUSE Linux Enterprise Module for Packagehub Subpackages
libconfuse
libconfuse0
libconfuse0-lang
libconfuse0-debuginfo
libconfuse-devel
libconfuse0-debugsource
libconfuse-debuginfo
libconfuse-debugsource

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

libconfuse - update to 2.7-4.4
libconfuse0 - addressed in versions 2.8-3.6.1, 2.8-150000.3.3.1
libconfuse0-lang - addressed in versions 2.8-3.6.1, 2.8-150000.3.3.1
libconfuse0-debuginfo - addressed in versions 2.8-3.6.1, 2.8-150000.3.3.1
libconfuse-devel - addressed in versions 2.8-3.6.1, 2.8-150000.3.3.1
libconfuse0-debugsource - addressed in versions 2.8-3.6.1, 2.8-150000.3.3.1
libconfuse - update to 3.3-2
libconfuse-debuginfo - update to 3.3-2
libconfuse-devel - update to 3.3-2
libconfuse-debugsource - update to 3.3-2
libconfuse - addressed in versions 3.3-7.el8, 3.3-7.el9, 3.3-7.fc35, 3.3-7.fc36, 3.3-7.fc37

• https://github.com/libconfuse/libconfuse/issues/163
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EDUT2V62V2XF2IT5TJFPB6P3EQ6X5VLL/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FJKHAPJ6AUWVP4HDGKH4M5A2XXWQI73O/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BSAZK4KAWRWNAFUBBXOYU3PVNH3X7226/

• Denial of service in libConfuse
• SUSE update for libconfuse0
• SUSE update for libconfuse0
• Amazon Linux AMI update for libconfuse
• openEuler update for libconfuse
• Fedora 36 update for libconfuse
• Fedora EPEL 8 update for libconfuse
• Fedora 37 update for libconfuse
• Fedora EPEL 9 update for libconfuse
• Fedora 35 update for libconfuse