CVE-2022-27239

Опубликовано: 27 апр. 2022

Источник: nvd

CVSS3: 7.8

CVSS2: 7.2

EPSS Низкий

Описание

In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges.

Ссылки

http://wiki.robotz.com/index.php/Linux_CIFS_Utils_and_Samba
Third Party Advisory
https://bugzilla.samba.org/show_bug.cgi?id=15025
Issue Tracking
Permissions Required
Vendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1197216
Issue Tracking
Patch
Third Party Advisory
https://github.com/piastry/cifs-utils/pull/7
Issue Tracking
Patch
Third Party Advisory
https://github.com/piastry/cifs-utils/pull/7/commits/955fb147e97a6a74e1aaa65766de91e2c1479765
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00020.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5WBOLMANBYJILXQKRRK7OCR774PXJAYY/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXKZLJYJJEC3TIBFLXUORRMZUKG5W676/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIYZ4L6SLSYJQ446VJAO2VGAESURQNSP/
https://security.gentoo.org/glsa/202311-05
https://www.debian.org/security/2022/dsa-5157
Third Party Advisory
http://wiki.robotz.com/index.php/Linux_CIFS_Utils_and_Samba
Third Party Advisory
https://bugzilla.samba.org/show_bug.cgi?id=15025
Issue Tracking
Permissions Required
Vendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1197216
Issue Tracking
Patch
Third Party Advisory
https://github.com/piastry/cifs-utils/pull/7
Issue Tracking
Patch
Third Party Advisory
https://github.com/piastry/cifs-utils/pull/7/commits/955fb147e97a6a74e1aaa65766de91e2c1479765
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00020.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5WBOLMANBYJILXQKRRK7OCR774PXJAYY/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXKZLJYJJEC3TIBFLXUORRMZUKG5W676/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIYZ4L6SLSYJQ446VJAO2VGAESURQNSP/

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:samba:cifs-utils:*:*:*:*:*:*:*:*

Версия до 6.15 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:suse:caas_platform:4.0:*:*:*:*:*:*:*

cpe:2.3:a:suse:enterprise_storage:6.0:*:*:*:*:*:*:*

cpe:2.3:a:suse:enterprise_storage:7.0:*:*:*:*:*:*:*

cpe:2.3:a:suse:linux_enterprise_point_of_service:11.0:sp3:*:*:*:*:*:*

cpe:2.3:a:suse:linux_enterprise_storage:7.1:*:*:*:*:*:*:*

cpe:2.3:a:suse:manager_proxy:4.1:*:*:*:*:*:*:*

cpe:2.3:a:suse:manager_proxy:4.2:*:*:*:*:*:*:*

cpe:2.3:a:suse:manager_proxy:4.3:*:*:*:*:*:*:*

cpe:2.3:a:suse:manager_retail_branch_server:4.1:*:*:*:*:*:*:*

cpe:2.3:a:suse:manager_retail_branch_server:4.2:*:*:*:*:*:*:*

cpe:2.3:a:suse:manager_retail_branch_server:4.3:*:*:*:*:*:*:*

cpe:2.3:a:suse:manager_server:4.1:*:*:*:*:*:*:*

cpe:2.3:a:suse:manager_server:4.2:*:*:*:*:*:*:*

cpe:2.3:a:suse:manager_server:4.3:*:*:*:*:*:*:*

cpe:2.3:a:suse:openstack_cloud:8.0:*:*:*:*:*:*:*

cpe:2.3:a:suse:openstack_cloud:9.0:*:*:*:*:*:*:*

cpe:2.3:a:suse:openstack_cloud_crowbar:8.0:*:*:*:*:*:*:*

cpe:2.3:a:suse:openstack_cloud_crowbar:9.0:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_desktop:15:sp3:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_desktop:15:sp4:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_high_performance_computing:12.0:sp5:*:*:-:*:*:*

cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:-:*:*:ltss:*:*:*

cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp1:*:*:espos:*:*:*

cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp1:*:*:ltss:*:*:*

cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp2:*:*:espos:*:*:*

cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp2:*:*:ltss:*:*:*

cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp3:*:*:-:*:*:*

cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp4:*:*:-:*:*:*

cpe:2.3:o:suse:linux_enterprise_micro:5.2:*:*:*:*:-:*:*

cpe:2.3:o:suse:linux_enterprise_micro:5.2:*:*:*:*:rancher:*:*

cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp2:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:-:*:*

cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:ltss:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:12:sp2:*:*:business_critical_linux:-:*:*

cpe:2.3:o:suse:linux_enterprise_server:12:sp3:*:*:*:sap:*:*

cpe:2.3:o:suse:linux_enterprise_server:12:sp3:*:*:business_critical_linux:-:*:*

cpe:2.3:o:suse:linux_enterprise_server:12:sp3:*:*:espos:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:12:sp3:*:*:ltss:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:-:sap:*:*

cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:espos:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:ltss:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:*:sap:*:*

cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:sap:*:*

cpe:2.3:o:suse:linux_enterprise_server:15:-:*:*:espos:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:15:-:*:*:ltss:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:15:sp1:*:*:business_critical_linux:-:*:*

cpe:2.3:o:suse:linux_enterprise_server:15:sp1:*:*:ltss:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:business_critical_linux:-:*:*

cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:ltss:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:15:sp3:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:15:sp4:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp5:*:*:*:*:*:*

Конфигурация 4

cpe:2.3:a:hp:helion_openstack:8.0:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

EPSS

Процентиль: 14%

0.00045

Низкий

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-787

Связанные уязвимости

CVE-2022-27239

CVSS3: 7.8

ubuntu

больше 3 лет назад

In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges.

CVE-2022-27239

CVSS3: 7

redhat

больше 3 лет назад

In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges.

CVE-2022-27239

CVSS3: 7.8

msrc

больше 3 лет назад

Описание отсутствует

CVE-2022-27239

CVSS3: 7.8

debian

больше 3 лет назад

In cifs-utils through 6.14, a stack-based buffer overflow when parsing ...

SUSE-SU-2022:2378-1

suse-cvrf

больше 3 лет назад

Security update for cifs-utils

EPSS

Процентиль: 14%

0.00045

Низкий

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-787