Vulnerability · Published May 6, 2025 · Assigned by GitHub_M
CVE-2025-32022Finit has heap based buffer overwrite in urandom.so plugin
Medium 4.6
In plain English
A medium-severity out-of-bounds write in finit from troglobit. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Finit provides fast init for Linux systems. Finit's urandom plugin has a heap buffer overwrite vulnerability at boot which leads to it overwriting other parts of the heap, possibly causing random instabilities and undefined behavior. The urandom plugin is enabled by default, so this bug affects everyone using Finit 4.2 or later that do not explicitly disable the plugin at build time. This bug is fixed in Finit 4.12. Those who cannot upgrade or backport the fix to urandom.c are strongly recommended to disable the plugin in the call to the `configure` script.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | finit | no fix listed | DEBIAN-CVE-2025-32022 |
| Debian:13 | finit | 4.12-1 | DEBIAN-CVE-2025-32022 |
| Debian:14 | finit | 4.12-1 | DEBIAN-CVE-2025-32022 |
| Ubuntu:22.04:LTS | finit | no fix listed | UBUNTU-CVE-2025-32022 |
| Ubuntu:24.04:LTS | finit | no fix listed | UBUNTU-CVE-2025-32022 |
| Ubuntu:25.10 | finit | no fix listed | UBUNTU-CVE-2025-32022 |
| Ubuntu:26.04:LTS | finit | no fix listed | UBUNTU-CVE-2025-32022 |
| Ubuntu:26.10 | finit | no fix listed | UBUNTU-CVE-2025-32022 |
Affected products (as reported)
Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:L