Stack-based buffer overflow in libeconf - CVE-2023-22652

Vulnerability identifier: #VU74040

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-22652

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the "read_file" function. A remote attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

libeconf
Amazon Linux AMI
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Basesystem Module
openSUSE Leap
Ubuntu
Anolis OS
Fedora
Red Hat OpenShift Kernel Module Management
Migration Toolkit for Virtualization
Red Hat Migration Toolkit for Applications
OpenShift Virtualization
Red Hat OpenShift Container Platform
libeconf (Ubuntu package)
libeconf
libeconf (Red Hat package)
libeconf-doc
libeconf-utils
libeconf-devel
libeconf0-debuginfo
libeconf0
libeconf-debugsource
libeconf0-32bit
libeconf0-64bit-debuginfo
libeconf0-64bit
libeconf0-32bit-debuginfo
libeconf-utils-debuginfo
ObjectScale
IBM Cloud Pak for Watson AIOps
Dell EMC VxRail Appliance

Install updates from vendor's website.

libeconf - update to 0.5.2
Red Hat OpenShift Kernel Module Management - update to 1.1.2
Migration Toolkit for Virtualization - update to 2.4.3
OpenShift Virtualization - update to 4.13.3
Red Hat OpenShift Container Platform - update to 4.13.8
Red Hat Migration Toolkit for Applications - update to 6.2.1
libeconf (Ubuntu package) - update to 0.3.8-1+deb11u1build0.22.04.1
libeconf - update to 0.4.0-1
libeconf (Red Hat package) - update to 0.4.1-3.el9_2
libeconf-doc - update to 0.5.2-1
libeconf-utils - update to 0.5.2-1
libeconf - update to 0.5.2-1
libeconf-devel - update to 0.5.2-1
libeconf - addressed in versions 0.5.2-1.fc37, 0.5.2-1.fc38, 0.5.2-1.fc39, 0.5.2-1.fc40
libeconf0-debuginfo - addressed in versions 0.5.2-150300.3.11.1, 0.5.2-150400.3.6.1
libeconf0 - addressed in versions 0.5.2-150300.3.11.1, 0.5.2-150400.3.6.1
libeconf-debugsource - addressed in versions 0.5.2-150300.3.11.1, 0.5.2-150400.3.6.1
libeconf0-32bit - update to 0.5.2-150400.3.6.1
libeconf0-64bit-debuginfo - update to 0.5.2-150400.3.6.1
libeconf0-64bit - update to 0.5.2-150400.3.6.1
libeconf0-32bit-debuginfo - update to 0.5.2-150400.3.6.1
libeconf-utils-debuginfo - update to 0.5.2-150400.3.6.1
libeconf-utils - update to 0.5.2-150400.3.6.1
libeconf-devel - update to 0.5.2-150400.3.6.1
ObjectScale - update to 1.4.0
IBM Cloud Pak for Watson AIOps - update to 4.1.2
Dell EMC VxRail Appliance - update to 8.0.120

• https://github.com/openSUSE/libeconf/releases/tag/v0.5.2
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22652
• https://github.com/openSUSE/libeconf/issues/177

• Multiple vulnerabilities in libeconf
• Red Hat Enterprise Linux 9 update for libeconf
• Multiple vulnerabilities in OpenShift Container Platform 4.13
• Multiple vulnerabilities in OpenShift Virtualization 4.13
• Fedora 40 update for libeconf
• Fedora 38 update for libeconf
• Fedora 37 update for libeconf
• Fedora 39 update for libeconf
• Multiple Vulnerabilities in IBM CloudPak for Watson AIOps
• SUSE update for libeconf
• SUSE update for libeconf
• SUSE update for libeconf
• Multiple vulnerabilities in Migration Toolkit for Applications 6.2
• Multiple vulnerabilities in Migration Toolkit for Virtualization 2.4
• Multiple vulnerabilities in Red Hat OpenShift Kernel Module Management 1.1
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in Dell ObjectScale
• Amazon Linux AMI update for libeconf
• Anolis OS update for libeconf
• Ubuntu update for libeconf