PT-2022-6819 · Ppp+3 · Ppp+3

Paul Mackerras · Published 2022-08-04 · Updated 2024-08-03 · CVE-2022-4603

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ppp (affected versions not specified)

Description The issue is related to the function dumpppp of the file pppdump/pppdump.c of the component pppdump. It involves improper validation of array index due to the manipulation of the argument spkt.buf/rpkt.buf. This could potentially allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The real existence of this vulnerability is still doubted at the moment.

Recommendations To fix this issue, it is recommended to apply a patch. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. As a temporary workaround, consider restricting the use of the dumpppp function until a patch is available. Additionally, note that pppdump is not used in the normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

AZL-11860

AZL-36979

BDU:2023-04814

CVE-2022-4603

OESA-2023-1015

OPENSUSE-SU-2023_4965-1

OPENSUSE-SU-2024:13529-1

SUSE-SU-2023:4961-1

SUSE-SU-2023:4965-1

SUSE-SU-2023_4961-1

SUSE-SU-2023_4965-1

SUSE-SU-2024:2380-1

Affected Products

Astra Linux

Debian

Suse

Ppp

References · 31

• https://github.com/ppp-project/ppp/commit/a75fb7b198eed50d769c80c36629f38346882cbf · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J43NP7ABHOCIWOFHWCH6ZCZOYKZH6723 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2380-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04814 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-4603 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-36979 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:4965-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-4603 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0727SE47 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4603 · Security Note
• https://osv.dev/vulnerability/AZL-11860 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:4961-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13529-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-4603 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-4603 · Vendor Advisory