PT-2022-4861 · Uclibc-Ng+2 · Uclibc-Ng+3

Published 2022-09-24 · Updated 2022-09-24 · CVE-2022-29504

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libpthread, linuxthreads, uClibC, and uClibC-ng (affected versions not specified)

Description The issue is related to a potential memory corruption in the al cpLocation function of the libpthread and linuxthreads libraries in uClibC and uClibC-ng. This could allow a remote attacker to execute arbitrary code by sending a specially crafted request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2022-05985

CVE-2022-29504

Affected Products

Libpthread

Linuxthreads

Uclibc

Uclibc-Ng

References · 4

• https://bdu.fstec.ru/vul/2022-05985 · Security Note
• https://redpacketsecurity.com/uclibc-and-uclibc-ng-code-execution-cve-2022-29504 · Note
• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1517 · Note
• https://uclibc-ng.org · Note