Vulnerability Details : CVE-2022-4904
Potential exploit
A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.
Vulnerability category: Input validationDenial of service
Products affected by CVE-2022-4904
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
- cpe:2.3:a:c-ares_project:c-ares:*:*:*:*:*:*:*:*
Threat overview for CVE-2022-4904
Top countries where our scanners detected CVE-2022-4904
Top open port discovered on systems with this issue
53
IPs affected by CVE-2022-4904 42,773
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2022-4904!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2022-4904
0.13%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 48 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-4904
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
8.6
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H |
3.9
|
4.7
|
NIST |
CWE ids for CVE-2022-4904
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by:
- nvd@nist.gov (Primary)
- secalert@redhat.com (Secondary)
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: secalert@redhat.com (Secondary)
-
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-4904
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33LDNS6RPOPP36Z4MPWXALUQZXJCWJS2/
[SECURITY] Fedora 36 Update: c-ares-1.19.0-1.fc36 - package-announce - Fedora Mailing-Lists
-
https://github.com/c-ares/c-ares/issues/496
Potential stack overflow in ares_set_sortlist · Issue #496 · c-ares/c-ares · GitHubExploit;Issue Tracking
-
https://security.gentoo.org/glsa/202401-02
c-ares: Multiple Vulnerabilities (GLSA 202401-02) — Gentoo security
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33LDNS6RPOPP36Z4MPWXALUQZXJCWJS2/
[SECURITY] Fedora 36 Update: c-ares-1.19.0-1.fc36 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=2168631
2168631 – (CVE-2022-4904) CVE-2022-4904 c-ares: buffer overflow in config_sortlist() due to missing string length checkIssue Tracking;Third Party Advisory
Jump to