Log in Start free

Vulnerability · Published Sep 13, 2022 · Assigned by microsoft

CVE-2022-38013.NET Core and Visual Studio Denial of Service Vulnerability

High 7.5

In plain English

A high-severity uncontrolled resource consumption in Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.0% (higher than 91% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)4.0%top 9.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

.NET Core and Visual Studio Denial of Service Vulnerability

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8aspnetcore-runtime-3.13.1.29-1.el8_6ALSA-2022:6523
AlmaLinux:8aspnetcore-runtime-6.06.0.9-1.el8_6ALSA-2022:6539
AlmaLinux:9aspnetcore-runtime-6.06.0.9-1.el9_0ALSA-2022:6521
AlmaLinux:8aspnetcore-targeting-pack-3.13.1.29-1.el8_6ALSA-2022:6523
AlmaLinux:8aspnetcore-targeting-pack-6.06.0.9-1.el8_6ALSA-2022:6539
AlmaLinux:9aspnetcore-targeting-pack-6.06.0.9-1.el9_0ALSA-2022:6521
AlmaLinux:8dotnet6.0.109-1.el8_6ALSA-2022:6539
AlmaLinux:8dotnet-apphost-pack-3.13.1.29-1.el8_6ALSA-2022:6523
AlmaLinux:8dotnet-apphost-pack-6.06.0.9-1.el8_6ALSA-2022:6539
AlmaLinux:9dotnet-apphost-pack-6.06.0.9-1.el9_0ALSA-2022:6521
AlmaLinux:8dotnet-host6.0.9-1.el8_6ALSA-2022:6539
AlmaLinux:9dotnet-host6.0.9-1.el9_0ALSA-2022:6521
AlmaLinux:8dotnet-hostfxr-3.13.1.29-1.el8_6ALSA-2022:6523
AlmaLinux:8dotnet-hostfxr-6.06.0.9-1.el8_6ALSA-2022:6539
AlmaLinux:9dotnet-hostfxr-6.06.0.9-1.el9_0ALSA-2022:6521
AlmaLinux:8dotnet-runtime-3.13.1.29-1.el8_6ALSA-2022:6523
AlmaLinux:8dotnet-runtime-6.06.0.9-1.el8_6ALSA-2022:6539
AlmaLinux:9dotnet-runtime-6.06.0.9-1.el9_0ALSA-2022:6521
AlmaLinux:8dotnet-sdk-3.13.1.423-1.el8_6ALSA-2022:6523
AlmaLinux:8dotnet-sdk-3.1-source-built-artifacts3.1.423-1.el8_6ALSA-2022:6523
AlmaLinux:8dotnet-sdk-6.06.0.109-1.el8_6ALSA-2022:6539
AlmaLinux:9dotnet-sdk-6.06.0.109-1.el9_0ALSA-2022:6521
AlmaLinux:8dotnet-sdk-6.0-source-built-artifacts6.0.109-1.el8_6ALSA-2022:6539
AlmaLinux:9dotnet-sdk-6.0-source-built-artifacts6.0.109-1.el9_0ALSA-2022:6521
AlmaLinux:8dotnet-targeting-pack-3.13.1.29-1.el8_6ALSA-2022:6523
AlmaLinux:8dotnet-targeting-pack-6.06.0.9-1.el8_6ALSA-2022:6539
AlmaLinux:9dotnet-targeting-pack-6.06.0.9-1.el9_0ALSA-2022:6521
AlmaLinux:8dotnet-templates-3.13.1.423-1.el8_6ALSA-2022:6523
AlmaLinux:8dotnet-templates-6.06.0.109-1.el8_6ALSA-2022:6539
AlmaLinux:9dotnet-templates-6.06.0.109-1.el9_0ALSA-2022:6521
AlmaLinux:8netstandard-targeting-pack-2.16.0.109-1.el8_6ALSA-2022:6539
AlmaLinux:9netstandard-targeting-pack-2.16.0.109-1.el9_0ALSA-2022:6521
Alpine:v3.20dotnet6-build6.0.109-r0ALPINE-CVE-2022-38013
Alpine:v3.20dotnet6-runtime6.0.9-r0ALPINE-CVE-2022-38013
NuGetmicrosoft.aspnetcore.app.runtime.linux-arm6.0.9GHSA-r8m2-4x37-6592
NuGetmicrosoft.aspnetcore.app.runtime.linux-arm3.1.29GHSA-r8m2-4x37-6592
NuGetmicrosoft.aspnetcore.app.runtime.linux-arm643.1.29GHSA-r8m2-4x37-6592
NuGetmicrosoft.aspnetcore.app.runtime.linux-arm646.0.9GHSA-r8m2-4x37-6592
NuGetmicrosoft.aspnetcore.app.runtime.linux-musl-arm6.0.9GHSA-r8m2-4x37-6592
NuGetmicrosoft.aspnetcore.app.runtime.linux-musl-arm643.1.29GHSA-r8m2-4x37-6592
NuGetmicrosoft.aspnetcore.app.runtime.linux-musl-arm646.0.9GHSA-r8m2-4x37-6592
NuGetmicrosoft.aspnetcore.app.runtime.linux-musl-x643.1.29GHSA-r8m2-4x37-6592
NuGetmicrosoft.aspnetcore.app.runtime.linux-musl-x646.0.9GHSA-r8m2-4x37-6592
NuGetmicrosoft.aspnetcore.app.runtime.linux-x643.1.29GHSA-r8m2-4x37-6592
NuGetmicrosoft.aspnetcore.app.runtime.linux-x646.0.9GHSA-r8m2-4x37-6592
NuGetmicrosoft.aspnetcore.app.runtime.osx-arm646.0.9GHSA-r8m2-4x37-6592
NuGetmicrosoft.aspnetcore.app.runtime.osx-x643.1.29GHSA-r8m2-4x37-6592
NuGetmicrosoft.aspnetcore.app.runtime.osx-x646.0.9GHSA-r8m2-4x37-6592
NuGetmicrosoft.aspnetcore.app.runtime.win-arm6.0.9GHSA-r8m2-4x37-6592
NuGetmicrosoft.aspnetcore.app.runtime.win-arm3.1.29GHSA-r8m2-4x37-6592
NuGetmicrosoft.aspnetcore.app.runtime.win-arm643.1.29GHSA-r8m2-4x37-6592
NuGetmicrosoft.aspnetcore.app.runtime.win-arm646.0.9GHSA-r8m2-4x37-6592
NuGetmicrosoft.aspnetcore.app.runtime.win-x646.0.9GHSA-r8m2-4x37-6592
NuGetmicrosoft.aspnetcore.app.runtime.win-x643.1.29GHSA-r8m2-4x37-6592
NuGetmicrosoft.aspnetcore.app.runtime.win-x863.1.29GHSA-r8m2-4x37-6592
NuGetmicrosoft.aspnetcore.app.runtime.win-x866.0.9GHSA-r8m2-4x37-6592
Rocky Linux:8dotnet3.10:3.1.423-1.el8_6RLSA-2022:6523
Rocky Linux:8dotnet6.00:6.0.109-1.el8_6RLSA-2022:6539
Ubuntu:22.04:LTSdotnet66.0.109-0ubuntu1~22.04.1UBUNTU-CVE-2022-38013
Ubuntu:22.04:LTSdotnet66.0.109-0ubuntu1~22.04.1USN-5609-1

Affected products (as reported)

VendorProductVersions
Microsoft Visual Studio 2022 for Mac version 17.3 17.3 – before 17.3.5
Microsoft Microsoft Visual Studio 2022 version 17.3 17.0.0 – before 17.3.4
Microsoft .NET Core 3.1 3.1 – before 3.1.29
Microsoft .NET 6.0 6.0.0 – before 6.0.9
Microsoft Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) 16.11.0 – before 16.11.19
Microsoft Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) 15.0.0 – before 16.9.25
Microsoft Microsoft Visual Studio 2022 version 17.0 17.0.0 – before 17.0.14
Microsoft Microsoft Visual Studio 2022 version 17.2 17.2.0 – before 17.2.8

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

References