Vulnerability · Published Sep 21, 2022 · Assigned by fedora
CVE-2022-29800
Medium 4.7
In plain English
A medium-severity security flaw in networkd-dispatcher. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 7.2% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
A time-of-check-time-of-use (TOCTOU) race condition vulnerability was found in networkd-dispatcher. This flaw exists because there is a certain time between the scripts being discovered and them being run. An attacker can abuse this vulnerability to replace scripts that networkd-dispatcher believes to be owned by root with ones that are not.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | networkd-dispatcher | 2.2.3-1 | DEBIAN-CVE-2022-29800 |
| Debian:13 | networkd-dispatcher | 2.2.3-1 | DEBIAN-CVE-2022-29800 |
| Debian:14 | networkd-dispatcher | 2.2.3-1 | DEBIAN-CVE-2022-29800 |
| Ubuntu:22.04:LTS | networkd-dispatcher | 2.1-2ubuntu0.22.04.1 | USN-5395-1 |
| Ubuntu:22.04:LTS | networkd-dispatcher | 2.1-2ubuntu0.22.04.1 | UBUNTU-CVE-2022-29800 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | networkd-dispatcher | uknown |
Weakness: CWE-367 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N