PT-2022-13263 · Unknown+2 · Util-Linux+2

Karel Zak · Published 2022-02-21 · Updated 2026-04-07 · CVE-2022-0563

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions util-linux versions prior to 2.37.4

Description A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an INPUTRC environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.

Recommendations For util-linux versions prior to 2.37.4, update to version 2.37.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the chfn and chsh utilities until a patch is available. Avoid using the INPUTRC environment variable in the affected utilities until the issue is resolved.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

ALT-PU-2022-2850

ALT-PU-2022-3036

AZL-8841

CVE-2022-0563

ECHO-0818-2C49-3F78

MGASA-2022-0076

OPENSUSE-SU-2024:11915-1

Affected Products

Alt Linux

Debian

Util-Linux

References · 29

• https://security-tracker.debian.org/tracker/CVE-2022-0563 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/SW73IARDAP7WWQ6ETYQB2OS2SLW4XTT3 · Vendor Advisory
• https://security.gentoo.org/glsa/202401-08 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0563 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2022-0563 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0076 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0076.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/2YUFRTN7YYS4ESW372SWK2PURGSGVDL4 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-8841 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11915-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5279-1 · Vendor Advisory
• https://debian.org/security/2022/dsa-5055 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0563 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2022-0563 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-0563 · Vendor Advisory