CVE-2022-1117

Published Aug 29, 2022

Last updated 2 years ago

Overview

Description: A vulnerability was found in fapolicyd. The vulnerability occurs due to an assumption on how glibc names the runtime linker, a build time regular expression may not correctly detect the runtime linker. The consequence is that the pattern detection for applications launched by the run time linker may fail to detect the pattern and allow execution.
Source: secalert@redhat.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.4
Impact score: 5.9
Exploitability score: 2.5
Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

secalert@redhat.com: CWE-552
nvd@nist.gov: CWE-552

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:fapolicyd_project:fapolicyd:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "77ED18CE-3E85-47C5-B5D3-9F2A846C75E5",
            "versionEndExcluding": "1.1.2"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References