CVE-2022-27239

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-27239
In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://wiki.robotz.com/index.php/Linux_CIFS_Utils_and_Samba Third Party Advisory
https://bugzilla.samba.org/show_bug.cgi?id=15025 Issue Tracking Permissions Required Vendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1197216 Issue Tracking Patch Third Party Advisory
https://github.com/piastry/cifs-utils/pull/7 Issue Tracking Patch Third Party Advisory
https://github.com/piastry/cifs-utils/pull/7/commits/955fb147e97a6a74e1aaa65766de91e2c1479765 Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00020.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5WBOLMANBYJILXQKRRK7OCR774PXJAYY/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXKZLJYJJEC3TIBFLXUORRMZUKG5W676/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIYZ4L6SLSYJQ446VJAO2VGAESURQNSP/
https://security.gentoo.org/glsa/202311-05
https://www.debian.org/security/2022/dsa-5157 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:samba:cifs-utils:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:suse:caas_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:a:suse:enterprise_storage:6.0:*:*:*:*:*:*:*
cpe:2.3:a:suse:enterprise_storage:7.0:*:*:*:*:*:*:*
cpe:2.3:a:suse:linux_enterprise_point_of_service:11.0:sp3:*:*:*:*:*:*
cpe:2.3:a:suse:linux_enterprise_storage:7.1:*:*:*:*:*:*:*
cpe:2.3:a:suse:manager_proxy:4.1:*:*:*:*:*:*:*
cpe:2.3:a:suse:manager_proxy:4.2:*:*:*:*:*:*:*
cpe:2.3:a:suse:manager_proxy:4.3:*:*:*:*:*:*:*
cpe:2.3:a:suse:manager_retail_branch_server:4.1:*:*:*:*:*:*:*
cpe:2.3:a:suse:manager_retail_branch_server:4.2:*:*:*:*:*:*:*
cpe:2.3:a:suse:manager_retail_branch_server:4.3:*:*:*:*:*:*:*
cpe:2.3:a:suse:manager_server:4.1:*:*:*:*:*:*:*
cpe:2.3:a:suse:manager_server:4.2:*:*:*:*:*:*:*
cpe:2.3:a:suse:manager_server:4.3:*:*:*:*:*:*:*
cpe:2.3:a:suse:openstack_cloud:8.0:*:*:*:*:*:*:*
cpe:2.3:a:suse:openstack_cloud:9.0:*:*:*:*:*:*:*
cpe:2.3:a:suse:openstack_cloud_crowbar:8.0:*:*:*:*:*:*:*
cpe:2.3:a:suse:openstack_cloud_crowbar:9.0:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:15:sp3:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:15:sp4:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_high_performance_computing:12.0:sp5:*:*:-:*:*:*
cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:-:*:*:ltss:*:*:*
cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp1:*:*:espos:*:*:*
cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp1:*:*:ltss:*:*:*
cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp2:*:*:espos:*:*:*
cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp2:*:*:ltss:*:*:*
cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp3:*:*:-:*:*:*
cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp4:*:*:-:*:*:*
cpe:2.3:o:suse:linux_enterprise_micro:5.2:*:*:*:*:-:*:*
cpe:2.3:o:suse:linux_enterprise_micro:5.2:*:*:*:*:rancher:*:*
cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp2:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:-:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:ltss:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:12:sp2:*:*:business_critical_linux:-:*:*
cpe:2.3:o:suse:linux_enterprise_server:12:sp3:*:*:*:sap:*:*
cpe:2.3:o:suse:linux_enterprise_server:12:sp3:*:*:business_critical_linux:-:*:*
cpe:2.3:o:suse:linux_enterprise_server:12:sp3:*:*:espos:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:12:sp3:*:*:ltss:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:-:sap:*:*
cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:espos:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:ltss:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:*:sap:*:*
cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:sap:*:*
cpe:2.3:o:suse:linux_enterprise_server:15:-:*:*:espos:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:15:-:*:*:ltss:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:15:sp1:*:*:business_critical_linux:-:*:*
cpe:2.3:o:suse:linux_enterprise_server:15:sp1:*:*:ltss:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:business_critical_linux:-:*:*
cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:ltss:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:15:sp3:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:15:sp4:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp5:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:a:hp:helion_openstack:8.0:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
History

No history.

Information

Published : 2022-04-27 14:15

Updated : 2023-11-24 15:15

NVD link : CVE-2022-27239

Mitre link : CVE-2022-27239

CVE.ORG link : CVE-2022-27239

JSON object : View

Products Affected

suse

  • linux_enterprise_desktop
  • linux_enterprise_high_performance_computing
  • linux_enterprise_storage
  • openstack_cloud
  • linux_enterprise_point_of_service
  • manager_proxy
  • linux_enterprise_real_time
  • manager_retail_branch_server
  • caas_platform
  • linux_enterprise_server
  • linux_enterprise_software_development_kit
  • enterprise_storage
  • linux_enterprise_micro
  • openstack_cloud_crowbar
  • manager_server

hp

  • helion_openstack

fedoraproject

  • fedora

samba

  • cifs-utils

debian

  • debian_linux
CWE
CWE-787

Out-of-bounds Write