CVE-2022-23089 - Vulnerability Details - OpenCVE

When dumping core and saving process information, proc_getargv() might return an sbuf which have a sbuf_len() of 0 or -1, which is not properly handled. An out-of-bound read can happen when user constructs a specially crafted ps_string, which in turn can cause the kernel to crash.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://security.freebsd.org/advisories/FreeBSD-SA-22:09.elf.asc
https://security.netapp.com/advisory/ntap-20240415-0006/

History

Thu, 13 Mar 2025 22:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
Metrics		cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Thu, 13 Feb 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: freebsd

Published: 2024-02-15T05:07:13.996Z

Updated: 2025-03-13T21:52:54.797Z

Reserved: 2022-01-10T22:07:46.041Z

Link: CVE-2022-23089

Vulnrichment

Updated: 2024-08-03T03:28:43.522Z

NVD

Status : Awaiting Analysis

Published: 2024-02-15T05:15:09.620

Modified: 2025-03-13T22:15:12.373

Link: CVE-2022-23089

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-23089", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "state": "PUBLISHED", "assignerShortName": "freebsd", "dateReserved": "2022-01-10T22:07:46.041Z", "datePublished": "2024-02-15T05:07:13.996Z", "dateUpdated": "2025-03-13T21:52:54.797Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["kernel"], "product": "FreeBSD", "vendor": "FreeBSD", "versions": [{"lessThan": "p1", "status": "affected", "version": "13.1-RELEASE", "versionType": "release"}, {"lessThan": "p12", "status": "affected", "version": "13.0-RELEASE", "versionType": "release"}, {"lessThan": "p6", "status": "affected", "version": "12.3-RELEASE", "versionType": "release"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Josef 'Jeff' Sipek"}], "datePublic": "2022-08-09T23:00:00.000Z", "descriptions": [{"lang": "en", "value": "When dumping core and saving process information, proc_getargv() might return an sbuf which have a sbuf_len() of 0 or -1, which is not properly handled.\n\nAn out-of-bound read can happen when user constructs a specially crafted ps_string, which in turn can cause the kernel to crash."}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2024-04-15T15:06:02.564Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-22:09.elf.asc"}, {"url": "https://security.netapp.com/advisory/ntap-20240415-0006/"}], "source": {"discovery": "UNKNOWN"}, "title": "Out of bound read in elf_note_prpsinfo()", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-125", "lang": "en", "description": "CWE-125 Out-of-bounds Read"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-02-15T20:01:04.904349Z", "id": "CVE-2022-23089", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-13T21:52:54.797Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:28:43.522Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-22:09.elf.asc"}, {"url": "https://security.netapp.com/advisory/ntap-20240415-0006/", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://security.freebsd.org/advisories/FreeBSD-SA-22:09.elf.asc", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240415-0006/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:28:43.522Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-23089", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-15T20:01:04.904349Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:10.983Z"}}], "cna": {"title": "Out of bound read in elf_note_prpsinfo()", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Josef 'Jeff' Sipek"}], "affected": [{"vendor": "FreeBSD", "modules": ["kernel"], "product": "FreeBSD", "versions": [{"status": "affected", "version": "13.1-RELEASE", "lessThan": "p1", "versionType": "release"}, {"status": "affected", "version": "13.0-RELEASE", "lessThan": "p12", "versionType": "release"}, {"status": "affected", "version": "12.3-RELEASE", "lessThan": "p6", "versionType": "release"}], "defaultStatus": "unknown"}], "datePublic": "2022-08-09T23:00:00.000Z", "references": [{"url": "https://security.freebsd.org/advisories/FreeBSD-SA-22:09.elf.asc", "tags": ["vendor-advisory"]}, {"url": "https://security.netapp.com/advisory/ntap-20240415-0006/"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "When dumping core and saving process information, proc_getargv() might return an sbuf which have a sbuf_len() of 0 or -1, which is not properly handled.\n\nAn out-of-bound read can happen when user constructs a specially crafted ps_string, which in turn can cause the kernel to crash."}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2024-04-15T15:06:02.564Z"}}}, "cveMetadata": {"cveId": "CVE-2022-23089", "state": "PUBLISHED", "dateUpdated": "2025-03-13T21:52:54.797Z", "dateReserved": "2022-01-10T22:07:46.041Z", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "datePublished": "2024-02-15T05:07:13.996Z", "assignerShortName": "freebsd"}, "dataVersion": "5.1"}