Stack-based buffer overflow in Perl - CVE-2022-48522

Vulnerability identifier: #VU83507

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-48522

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the S_find_uninit_var() function in sv.c. A remote attacker can pass specially crafted input to the application, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Perl
Ubuntu
openEuler
perl (Ubuntu package)
perl
perl-debugsource
perl-debuginfo
perl-devel
perl-libs
perl-help
Juniper Cloud Native Router
Junos cRPD

Install updates from vendor's website.

Perl - addressed in versions 5.34.2, 5.36.2, 5.38.1, 5.39.5
perl (Ubuntu package) - addressed in versions 5.30.0-9ubuntu0.5, 5.34.0-3ubuntu1.3, 5.36.0-7ubuntu0.23.04.2, 5.36.0-9ubuntu1.1
perl - update to 5.34.0-9
perl-debugsource - update to 5.34.0-9
perl-debuginfo - update to 5.34.0-9
perl-devel - update to 5.34.0-9
perl-libs - update to 5.34.0-9
perl-help - update to 5.34.0-9
Juniper Cloud Native Router - update to 23.4R1
Junos cRPD - update to 23.4R1

• https://github.com/Perl/perl5/blob/79a7b254d85a10b65126ad99bf10e70480569d68/sv.c#L16336-L16345

• Multiple vulnerabilities in Perl
• Ubuntu update for perl
• openEuler 22.03 LTS update for perl
• openEuler 22.03 LTS SP1 update for perl
• openEuler 22.03 LTS SP2 update for perl
• Multiple vulnerabilities in Juniper Cloud Native Router
• Multiple vulnerabilities in Juniper Networks Junos cRPD