CVE-2022-0563
CVSS V2 Low 1.9
CVSS V3 Medium 5.5
Description
A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.
Overview
- CVE ID
- CVE-2022-0563
- Assigner
- secalert@redhat.com
- Vulnerability Status
- Analyzed
- Published Version
- 2022-02-21T19:15:08
- Last Modified Date
- 2022-06-03T14:15:15
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:kernel:util-linux:*:*:*:*:*:*:*:* | 1 | OR | 2.37.4 | |
| cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* | 1 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:L/AC:M/Au:N/C:P/I:N/A:N
- Access Vector
- LOCAL
- Access Compatibility
- MEDIUM
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- NONE
- Availability Impact
- NONE
- Base Score
- 1.9
- Severity
- LOW
- Exploitability Score
- 3.4
- Impact Score
- 2.9
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Attack Vector
- LOCAL
- Attack Compatibility
- LOW
- Privileges Required
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- NONE
- Base Score
- 5.5
- Base Severity
- MEDIUM
- Exploitability Score
- 1.8
- Impact Score
- 3.6
References
| Reference URL | Reference Tags |
|---|---|
| https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w@ws.net.home/T/#u | Mailing List Patch Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20220331-0002/ |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2022-0563 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0563 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-04-04 00:39:51 | Added to TrackCVE | |||
| 2022-12-06 10:30:26 | 2022-02-21T19:15Z | 2022-02-21T19:15:08 | CVE Published Date | updated |
| 2022-12-06 10:30:26 | 2022-06-03T14:15:15 | CVE Modified Date | updated | |
| 2022-12-06 10:30:26 | Analyzed | Vulnerability Status | updated |