CVE-2022-48522
Description
A stack-based buffer overflow vulnerability was found in the S_find_uninit_var() function in sv.c in Perl. This issue may allow an authenticated local attacker to send a specially crafted request to the application, leading to an infinite recursion, exhausting the process' stack space, resulting in a denial of service.
Statement
The vulnerable code was introduced in Perl v5.33.1. Red Hat Enterprise Linux ships Perl v5.32.1 and lower. Our code-base does not contain the vulnerable code, therefore, RHEL is not affected.
When attempting to access a hash entry with an undefined variable as the key, an infinite recursion occurs, depleting the stack space and leading to a stack overflow. This behavior is specific to cases where '-w' ("use warnings;") are enabled.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 9.8 | N/A |
| Attack Vector | Local | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | High | N/A |
| Integrity Impact | None | High | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
This issue manifests as an infinite recursion when attempting to display a warning message, resulting in the process exhausting its stack space. The security impact of this occurrence is considered negligible.
Additionally, with Confidentiality and Integrity set to None, it's worth noting that Perl packages included in RHEL are constructed with stack-slash protection enabled. This configuration limits potential exploitation causing a Denial of Service and does not compromise confidentiality or integrity.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Amplification
An infinite loop will cause unexpected consumption of resources, such as CPU cycles or memory. The software's operation may slow down, or cause a long time to respond.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
