Vulnerability · Published Jan 11, 2023 · Assigned by redhat
CVE-2022-4415
Medium 5.5
In plain English
A medium-severity information exposure in systemd. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.8%top 42.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | systemd | 239-68.el8_7.4 | ALSA-2023:0837 |
| AlmaLinux:9 | systemd | 250-12.el9_1.3 | ALSA-2023:0954 |
| AlmaLinux:8 | systemd-container | 239-68.el8_7.4 | ALSA-2023:0837 |
| AlmaLinux:9 | systemd-container | 250-12.el9_1.3 | ALSA-2023:0954 |
| AlmaLinux:8 | systemd-devel | 239-68.el8_7.4 | ALSA-2023:0837 |
| AlmaLinux:9 | systemd-devel | 250-12.el9_1.3 | ALSA-2023:0954 |
| AlmaLinux:8 | systemd-journal-remote | 239-68.el8_7.4 | ALSA-2023:0837 |
| AlmaLinux:9 | systemd-journal-remote | 250-12.el9_1.3 | ALSA-2023:0954 |
| AlmaLinux:8 | systemd-libs | 239-68.el8_7.4 | ALSA-2023:0837 |
| AlmaLinux:9 | systemd-libs | 250-12.el9_1.3 | ALSA-2023:0954 |
| AlmaLinux:9 | systemd-oomd | 250-12.el9_1.3 | ALSA-2023:0954 |
| AlmaLinux:8 | systemd-pam | 239-68.el8_7.4 | ALSA-2023:0837 |
| AlmaLinux:9 | systemd-pam | 250-12.el9_1.3 | ALSA-2023:0954 |
| AlmaLinux:9 | systemd-resolved | 250-12.el9_1.3 | ALSA-2023:0954 |
| AlmaLinux:9 | systemd-rpm-macros | 250-12.el9_1.3 | ALSA-2023:0954 |
| AlmaLinux:8 | systemd-tests | 239-68.el8_7.4 | ALSA-2023:0837 |
| AlmaLinux:8 | systemd-udev | 239-68.el8_7.4 | ALSA-2023:0837 |
| AlmaLinux:9 | systemd-udev | 250-12.el9_1.3 | ALSA-2023:0954 |
| Debian:12 | systemd | 252.4-1 | DEBIAN-CVE-2022-4415 |
| Debian:13 | systemd | 252.4-1 | DEBIAN-CVE-2022-4415 |
| Debian:14 | systemd | 252.4-1 | DEBIAN-CVE-2022-4415 |
| Rocky Linux:8 | systemd | 0:239-68.el8_7.4 | RLSA-2023:0837 |
| Rocky Linux:9 | systemd | 0:250-12.el9_1.3 | RLSA-2023:0954 |
| Ubuntu:22.04:LTS | systemd | 249.11-0ubuntu3.7 | USN-5928-1 |
| Ubuntu:22.04:LTS | systemd | 249.11-0ubuntu3.7 | UBUNTU-CVE-2022-4415 |
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N