CVE-2022-1117

2022-08-2915:15:10

CWE-552

redhat

web.nvd.nist.gov

127

vulnerability

fapolicyd

cve-2022-1117

glibc

runtime linker

pattern detection

execution

CVSS3

8.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.1

Confidence

High

EPSS

0.001

Percentile

41.1%

JSON

A vulnerability was found in fapolicyd. The vulnerability occurs due to an assumption on how glibc names the runtime linker, a build time regular expression may not correctly detect the runtime linker. The consequence is that the pattern detection for applications launched by the run time linker may fail to detect the pattern and allow execution.

Affected configurations

Nvd

Vulners

Node

fapolicyd_projectfapolicydRange<1.1.2

VendorProductVersionCPE
fapolicyd_projectfapolicyd*cpe:2.3:a:fapolicyd_project:fapolicyd:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fapolicyd_project	fapolicyd	*	cpe:2.3:a:fapolicyd_project:fapolicyd::::::::

CNA Affected

[
  {
    "product": "fapolicyd",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in v1.1.2"
      }
    ]
  }
]