PT-2022-3642 · Swhkd · Swhkd

Mgerstner · Published 2022-04-06 · Updated 2023-08-08 · CVE-2022-27819

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions SWHKD version 1.1.5

Description The issue is related to unsafe parsing via the -c option, which can lead to an information leak or a denial of service (memory exhaustion) when attempting to parse large or infinite files, such as block or character devices.

Recommendations For SWHKD version 1.1.5, consider disabling the use of the -c option until a patch is available to prevent potential memory exhaustion and information leaks. Restrict access to large or infinite files to minimize the risk of exploitation.

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

BDU:2022-04427

CVE-2022-27819

GHSA-H6XW-MGHQ-7523

Affected Products

Swhkd

References · 12

• https://github.com/waycrate/swhkd/commit/b4e6dc76f4845ab03104187a42ac6d1bbc1e0021 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-27819 · Security Note
• https://osv.dev/vulnerability/GHSA-h6xw-mghq-7523 · Vendor Advisory
• http://openwall.com/lists/oss-security/2022/04/14/1 · Patch
• https://osv.dev/vulnerability/CVE-2022-27819 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04427 · Security Note
• https://github.com/waycrate/swhkd/releases · Note
• https://github.com/waycrate/swhkd/releases/tag/1.2.0 · Note
• https://github.com/waycrate/swhkd · Note
• https://vuldb.com/ru/?id.196625 · Note
• https://t.me/cibsecurity/40276 · Telegram Post
• https://t.me/cvenotify/28558 · Telegram Post