Log in Start free

Vulnerability · Published Nov 8, 2022 · Assigned by GitHub_M

CVE-2022-39377sysstat Incorrect Buffer Size calculation on 32-bit systems results in RCE via buffer overflow

High 7.0

In plain English

A high-severity buffer overflow in sysstat from sysstat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)1.4%top 28.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_structures contains a size_t overflow in sa_common.c. The allocate_structures function insufficiently checks bounds before arithmetic multiplication, allowing for an overflow in the size allocated for the buffer representing system activities. This issue may lead to Remote Code Execution (RCE). This issue has been patched in version 12.7.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8sysstat11.7.3-9.el8ALSA-2023:2800
AlmaLinux:9sysstat12.5.4-5.el9ALSA-2023:2234
Alpine:v3.21sysstat12.6.2-r0ALPINE-CVE-2022-39377
Alpine:v3.22sysstat12.6.2-r0ALPINE-CVE-2022-39377
Alpine:v3.23sysstat12.6.2-r0ALPINE-CVE-2022-39377
Alpine:v3.24sysstat12.6.2-r0ALPINE-CVE-2022-39377
Debian:12sysstat12.6.1-1DEBIAN-CVE-2022-39377
Debian:13sysstat12.6.1-1DEBIAN-CVE-2022-39377
Debian:14sysstat12.6.1-1DEBIAN-CVE-2022-39377
Ubuntu:22.04:LTSsysstat12.5.2-2ubuntu0.1USN-5748-1
Ubuntu:22.04:LTSsysstat12.5.2-2ubuntu0.2USN-6145-1
Ubuntu:22.04:LTSsysstat12.5.2-2ubuntu0.1UBUNTU-CVE-2022-39377

Affected products (as reported)

VendorProductVersions
sysstat sysstat >= 9.1.16, < 12.7.1

Weakness: CWE-131, CWE-120 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References