Log in Start free

Vulnerability · Published Feb 21, 2022 · Assigned by redhat

CVE-2022-0563

Medium 5.5

In plain English

A medium-severity security flaw in util-linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.4%top 62.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20util-linux2.37.4-r0ALPINE-CVE-2022-0563
Alpine:v3.21util-linux2.37.4-r0ALPINE-CVE-2022-0563
Alpine:v3.22util-linux2.37.4-r0ALPINE-CVE-2022-0563
Alpine:v3.23util-linux2.37.4-r0ALPINE-CVE-2022-0563
Alpine:v3.24util-linux2.37.4-r0ALPINE-CVE-2022-0563
Debian:12util-linuxno fix listedDEBIAN-CVE-2022-0563
Debian:13util-linuxno fix listedDEBIAN-CVE-2022-0563
Debian:14util-linuxno fix listedDEBIAN-CVE-2022-0563

Affected products (as reported)

VendorProductVersions
n/a util-linux util-linux 2.37.4

Weakness: CWE-209 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References