{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-24903", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "dateUpdated": "2024-08-03T04:29:01.617Z", "dateReserved": "2022-02-10T00:00:00", "datePublished": "2022-05-05T00:00:00"}, "containers": {"cna": {"title": "Buffer overflow in TCP syslog server (receiver) components in rsyslog", "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-11-14T00:00:00"}, "descriptions": [{"lang": "en", "value": "Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability can not be used for remote code execution. But there may still be a slight chance for experts to do that. The bug occurs when the octet count is read. While there is a check for the maximum number of octets, digits are written to a heap buffer even when the octet count is over the maximum, This can be used to overrun the memory buffer. However, once the sequence of digits stop, no additional characters can be added to the buffer. In our opinion, this makes remote exploits impossible or at least highly complex. Octet-counted framing is one of two potential framing modes. It is relatively uncommon, but enabled by default on receivers. Modules `imtcp`, `imptcp`, `imgssapi`, and `imhttp` are used for regular syslog message reception. It is best practice not to directly expose them to the public. When this practice is followed, the risk is considerably lower. Module `imdiag` is a diagnostics module primarily intended for testbench runs. We do not expect it to be present on any production installation. Octet-counted framing is not very common. Usually, it needs to be specifically enabled at senders. If users do not need it, they can turn it off for the most important modules. This will mitigate the vulnerability."}], "affected": [{"vendor": "rsyslog", "product": "rsyslog", "versions": [{"version": "< 8.2204.1", "status": "affected"}]}], "references": [{"url": "https://github.com/rsyslog/rsyslog/security/advisories/GHSA-ggw7-xr6h-mmr8"}, {"url": "https://github.com/rsyslog/rsyslog/commit/f211042ecbb472f9d8beb4678a65d272b6f07705"}, {"name": "FEDORA-2022-f796a28a7b", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GMNNXLCU2UORRVSZO24HL4KMVPK5PHVW/"}, {"name": "[debian-lts-announce] 20220520 [SECURITY] [DLA 3016-1] rsyslog security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00028.html"}, {"name": "DSA-5150", "tags": ["vendor-advisory"], "url": "https://www.debian.org/security/2022/dsa-5150"}, {"url": "https://security.netapp.com/advisory/ntap-20221111-0002/"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "cweId": "CWE-120"}]}], "source": {"advisory": "GHSA-ggw7-xr6h-mmr8", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:29:01.617Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/rsyslog/rsyslog/security/advisories/GHSA-ggw7-xr6h-mmr8", "tags": ["x_transferred"]}, {"url": "https://github.com/rsyslog/rsyslog/commit/f211042ecbb472f9d8beb4678a65d272b6f07705", "tags": ["x_transferred"]}, {"name": "FEDORA-2022-f796a28a7b", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GMNNXLCU2UORRVSZO24HL4KMVPK5PHVW/"}, {"name": "[debian-lts-announce] 20220520 [SECURITY] [DLA 3016-1] rsyslog security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00028.html"}, {"name": "DSA-5150", "tags": ["vendor-advisory", "x_transferred"], "url": "https://www.debian.org/security/2022/dsa-5150"}, {"url": "https://security.netapp.com/advisory/ntap-20221111-0002/", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rsyslog:rsyslog:*:*:*:*:*:*:*:*", "matchCriteriaId": "44AF6D1B-803C-48AB-ABEC-541C3B9CD726", "versionEndExcluding": "8.2204.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*", "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*", "matchCriteriaId": "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability can not be used for remote code execution. But there may still be a slight chance for experts to do that. The bug occurs when the octet count is read. While there is a check for the maximum number of octets, digits are written to a heap buffer even when the octet count is over the maximum, This can be used to overrun the memory buffer. However, once the sequence of digits stop, no additional characters can be added to the buffer. In our opinion, this makes remote exploits impossible or at least highly complex. Octet-counted framing is one of two potential framing modes. It is relatively uncommon, but enabled by default on receivers. Modules `imtcp`, `imptcp`, `imgssapi`, and `imhttp` are used for regular syslog message reception. It is best practice not to directly expose them to the public. When this practice is followed, the risk is considerably lower. Module `imdiag` is a diagnostics module primarily intended for testbench runs. We do not expect it to be present on any production installation. Octet-counted framing is not very common. Usually, it needs to be specifically enabled at senders. If users do not need it, they can turn it off for the most important modules. This will mitigate the vulnerability."}, {"lang": "es", "value": "Rsyslog es un sistema muy r\u00e1pido para el procesamiento de registros. Los m\u00f3dulos para la recepci\u00f3n de syslogs por TCP presentan un potencial desbordamiento del buffer de pila cuando es usado el framing de conteo de octetos. Esto puede resultar en un segfault o alg\u00fan otro mal funcionamiento. A nuestro entender, esta vulnerabilidad no puede ser usada para una ejecuci\u00f3n de c\u00f3digo remota. Pero todav\u00eda puede haber una peque\u00f1a posibilidad de que los expertos lo hagan. El fallo es producido cuando es le\u00eddo el recuento de octetos. Mientras se presenta una comprobaci\u00f3n del n\u00famero m\u00e1ximo de octetos, los d\u00edgitos son escritos en un b\u00fafer de mont\u00f3n incluso cuando el recuento de octetos supera el m\u00e1ximo, lo que puede usarse para sobrepasar el b\u00fafer de memoria. Sin embargo, una vez que la secuencia de d\u00edgitos es detenida, no pueden a\u00f1adirse m\u00e1s caracteres al b\u00fafer. En nuestra opini\u00f3n, esto hace que las explotaciones remotas sean imposibles o, al menos, muy complejos. El encuadre de octetos es uno de los dos modos de encuadre posibles. Es relativamente infrecuente, pero est\u00e1 habilitado por defecto en los receptores. Los m\u00f3dulos \"imtcp\", \"imptcp\", \"imgssapi\" y \"imhttp\" son usados para la recepci\u00f3n regular de mensajes syslog. Es una buena pr\u00e1ctica no exponerlos directamente al p\u00fablico. Cuando es seguida esta pr\u00e1ctica, el riesgo es considerablemente menor. El m\u00f3dulo \"imdiag\" es un m\u00f3dulo de diagn\u00f3stico destinado principalmente a las ejecuciones de los bancos de pruebas. No esperamos que est\u00e9 presente en ninguna instalaci\u00f3n de producci\u00f3n. El framing de octetos no es muy com\u00fan. Normalmente, es necesario habilitarlo espec\u00edficamente en los remitentes. Si los usuarios no lo necesitan, pueden deshabilitarlo para los m\u00f3dulos m\u00e1s importantes. Esto mitigar\u00e1 la vulnerabilidad"}], "id": "CVE-2022-24903", "lastModified": "2024-11-21T06:51:21.620", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-05-06T00:15:07.873", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/rsyslog/rsyslog/commit/f211042ecbb472f9d8beb4678a65d272b6f07705"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/rsyslog/rsyslog/security/advisories/GHSA-ggw7-xr6h-mmr8"}, {"source": "security-advisories@github.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00028.html"}, {"source": "security-advisories@github.com", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GMNNXLCU2UORRVSZO24HL4KMVPK5PHVW/"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20221111-0002/"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2022/dsa-5150"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/rsyslog/rsyslog/commit/f211042ecbb472f9d8beb4678a65d272b6f07705"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/rsyslog/rsyslog/security/advisories/GHSA-ggw7-xr6h-mmr8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00028.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GMNNXLCU2UORRVSZO24HL4KMVPK5PHVW/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20221111-0002/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2022/dsa-5150"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-1284"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank Pieter Agten (Fortanix) for reporting this issue.", "affected_release": [{"advisory": "RHSA-2022:4808", "cpe": "cpe:/o:redhat:rhel_els:6", "package": "rsyslog-0:5.8.10-12.el6_10.1", "product_name": "Red Hat Enterprise Linux 6 Extended Lifecycle Support", "release_date": "2022-05-31T00:00:00Z"}, {"advisory": "RHSA-2022:4808", "cpe": "cpe:/o:redhat:rhel_els:6", "package": "rsyslog7-0:7.4.10-7.el6_10.1", "product_name": "Red Hat Enterprise Linux 6 Extended Lifecycle Support", "release_date": "2022-05-31T00:00:00Z"}, {"advisory": "RHSA-2022:4803", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "rsyslog-0:8.24.0-57.el7_9.3", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2022-05-30T00:00:00Z"}, {"advisory": "RHSA-2022:4799", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "rsyslog-0:8.2102.0-7.el8_6.1", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-05-30T00:00:00Z"}, {"advisory": "RHSA-2022:4801", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "rsyslog-0:8.37.0-13.el8_1.1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-05-30T00:00:00Z"}, {"advisory": "RHSA-2022:4800", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "rsyslog-0:8.1911.0-3.el8_2.1", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2022-05-30T00:00:00Z"}, {"advisory": "RHSA-2022:4802", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "rsyslog-0:8.1911.0-7.el8_4.3", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-05-30T00:00:00Z"}, {"advisory": "RHSA-2022:4795", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "rsyslog-0:8.2102.0-101.el9_0.1", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2022-05-30T00:00:00Z"}, {"advisory": "RHSA-2022:4803", "cpe": "cpe:/o:redhat:enterprise_linux:7::hypervisor", "package": "rsyslog-0:8.24.0-57.el7_9.3", "product_name": "Red Hat Virtualization 4 for Red Hat Enterprise Linux 7", "release_date": "2022-05-30T00:00:00Z"}, {"advisory": "RHSA-2022:5439", "cpe": "cpe:/o:redhat:enterprise_linux:7::hypervisor", "package": "redhat-virtualization-host-0:4.3.23-20220622.0.el7_9", "product_name": "Red Hat Virtualization 4 for Red Hat Enterprise Linux 7", "release_date": "2022-07-01T00:00:00Z"}, {"advisory": "RHSA-2022:4896", "cpe": "cpe:/o:redhat:rhev_hypervisor:4.4::el8", "package": "redhat-virtualization-host-0:4.5.0-202205291010_8.6", "product_name": "Red Hat Virtualization 4 for Red Hat Enterprise Linux 8", "release_date": "2022-06-03T00:00:00Z"}, {"advisory": "RHSA-2022:4803", "cpe": "cpe:/a:redhat:rhev_manager:4.3", "package": "rsyslog-0:8.24.0-57.el7_9.3", "product_name": "Red Hat Virtualization Engine 4.3", "release_date": "2022-05-30T00:00:00Z"}], "bugzilla": {"description": "rsyslog: Heap-based overflow in TCP syslog server", "id": "2081353", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2081353"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-787", "details": ["Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability can not be used for remote code execution. But there may still be a slight chance for experts to do that. The bug occurs when the octet count is read. While there is a check for the maximum number of octets, digits are written to a heap buffer even when the octet count is over the maximum, This can be used to overrun the memory buffer. However, once the sequence of digits stop, no additional characters can be added to the buffer. In our opinion, this makes remote exploits impossible or at least highly complex. Octet-counted framing is one of two potential framing modes. It is relatively uncommon, but enabled by default on receivers. Modules `imtcp`, `imptcp`, `imgssapi`, and `imhttp` are used for regular syslog message reception. It is best practice not to directly expose them to the public. When this practice is followed, the risk is considerably lower. Module `imdiag` is a diagnostics module primarily intended for testbench runs. We do not expect it to be present on any production installation. Octet-counted framing is not very common. Usually, it needs to be specifically enabled at senders. If users do not need it, they can turn it off for the most important modules. This will mitigate the vulnerability.", "A flaw was found in rsyslog's reception TCP modules. This flaw allows an attacker to craft a malicious message leading to a heap-based buffer overflow. This issue allows the attacker to corrupt or access data stored in memory, leading to a denial of service in the rsyslog or possible remote code execution."], "name": "CVE-2022-24903", "public_date": "2022-05-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-24903\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-24903\nhttps://github.com/rsyslog/rsyslog/security/advisories/GHSA-ggw7-xr6h-mmr8"], "threat_severity": "Important", "upstream_fix": "rsyslog 8.2204.1"}