PT-2022-7425 · Sysstat+10 · Sysstat+10

Published 2022-11-08 · Updated 2025-10-17 · CVE-2022-39377

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sysstat versions 9.1.16 through 12.7.0

Description The issue is related to the allocate structures function in sa common.c, which insufficiently checks bounds before arithmetic multiplication, allowing for an overflow in the size allocated for the buffer representing system activities. This may lead to Remote Code Execution (RCE). The allocate structures function is vulnerable due to a size t overflow.

Recommendations For versions 9.1.16 through 12.7.0, update to version 12.7.1 to resolve the issue. As a temporary workaround, consider disabling the allocate structures function until a patch is available.

Exploit

Fix

DoS

RCE

Buffer Overflow

Weakness Enumeration

CWE-131

CWE-120

Related Identifiers

ALSA-2023:2234

ALSA-2023:2800

ALSA-2023_2234

ALSA-2023_2800

ALT-PU-2022-3125

ALT-PU-2022-3130

ALT-PU-2022-3265

ALT-PU-2022-3269

AZL-11450

BDU:2024-06029

CESA-2023_2800

CVE-2022-39377

DLA-3188-1

DLA-3434-1

DLA-4336-1

GHSA-Q8R6-G56F-9W7X

MGASA-2022-0433

OESA-2022-2107

OPENSUSE-SU-2024:12658-1

OPENSUSE-SU-2025_0019-1

RHSA-2023:2234

RHSA-2023:2800

RHSA-2023_2234

RHSA-2023_2800

ROSA-SA-2023-2198

ROSA-SA-2025-2663

SUSE-SU-2025:0012-1

SUSE-SU-2025:0019-1

SUSE-SU-2025_0012-1

SUSE-SU-2025_0019-1

USN-5735-1

USN-5748-1

USN-6145-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Debian

Linuxmint

Red Hat

Red Os

Suse

Ubuntu

Sysstat

References · 69

• 🔥 https://github.com/sysstat/sysstat/security/advisories/GHSA-q8r6-g56f-9w7x · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39377.json · Exploit
• https://ubuntu.com/security/CVE-2022-39377 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39377 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0433.html · Security Note
• https://osv.dev/vulnerability/OESA-2022-2107 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5735-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5735-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39377 · Security Note
• https://osv.dev/vulnerability/MGASA-2022-0433 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-11450 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7X6WKTODOUDV6M3HZMASYNZP6EM4N7W4 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-2800.html · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3188-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHUVUDIVDJZ7AVXD3XX3NBXXXKPOKN3N · Vendor Advisory