PT-2022-4862 · Uclibc-Ng+3 · Uclibc-Ng+3

Lilith >_> · Published 2022-09-24 · Updated 2023-06-28 · CVE-2022-29503

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions uClibC version 0.9.33.2 uClibC-ng version 1.0.40

Description A memory corruption issue exists in the libpthread linuxthreads functionality. This can be triggered by thread allocation, leading to memory corruption. An attacker can exploit this by creating threads. The exploitation of this issue may allow a remote attacker to execute arbitrary code by sending a specially crafted request.

Recommendations For uClibC version 0.9.33.2, consider restricting thread allocation to minimize the risk of exploitation. For uClibC-ng version 1.0.40, consider disabling the libpthread linuxthreads functionality until a patch is available. As a temporary workaround, avoid using the al cpLocation function in the affected libpthread and linuxthreads libraries to prevent memory corruption.

Exploit

Fix

Allocation of Resources Without Limits

Buffer Overflow

Weakness Enumeration

CWE-770

CWE-119

Related Identifiers

AZL-27304

BDU:2022-05986

CVE-2022-29503

Affected Products

Debian

Libpthread

Uclibc

Uclibc-Ng

References · 9

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1517 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2022-29503 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29503 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29503 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-27304 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-29503 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05986 · Security Note
• https://uclibc-ng.org · Note
• https://redpacketsecurity.com/uclibc-and-uclibc-ng-code-execution-cve-2022-29503 · Note