PT-2023-2366 · Unknown+2 · Netwide Assembler+2

13579And24680 · Published 2023-03-29 · Updated 2024-12-16 · CVE-2022-44370

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Netwide Assembler (NASM) version 2.16

Description The issue is related to a heap buffer overflow in the quote for pmake() function of the Netwide Assembler (NASM). This overflow can occur due to the operation exceeding the memory buffer boundaries. Exploitation of this issue may allow an attacker to execute arbitrary code.

Recommendations For Netwide Assembler (NASM) version 2.16, consider disabling the quote for pmake() function as a temporary workaround until a patch is available.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2023-1613

ALT-PU-2024-16552

ALT-PU-2024-16908

AZL-25934

BDU:2023-02141

CVE-2022-44370

OESA-2023-1245

Affected Products

Alt Linux

Debian

Netwide Assembler

References · 19

• 🔥 https://bugzilla.nasm.us/show_bug.cgi?id=3392815 · Exploit
• https://bdu.fstec.ru/vul/2023-02141 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-44370 · Security Note
• https://ubuntu.com/security/CVE-2022-44370 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2022-44370 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-44370 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1245 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-44370 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-44370 · Security Note
• https://osv.dev/vulnerability/AZL-25934 · Vendor Advisory
• https://security.gentoo.org/glsa/202312-09 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-44370 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-44370 · Vendor Advisory
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1245 · Note
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.9 · Note