CVE-2022-36227

Katalog CVE

CVSS 9.8 · Critical EPSS 2,4%

Kerentanan NULL Pointer Dereference pada libarchive, debian linux +2 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution."

Rincian

Terbit di NVD

22 November 2022

Terakhir diubah

8 Oktober 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

2,4% peluang dieksploitasi; lebih tinggi dari 83,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugs.gentoo.org/882521 issue tracking · patch · advisory pihak ketiga
• https://github.com/libarchive/libarchive/issues/1754 issue tracking · patch · advisory pihak ketiga
• https://github.com/libarchive/libarchive/blob/v3.0.0a/libarchive/archive_write.c#L215 advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/01/msg00034.html advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V67OO2UUQAUJS... mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202309-14 advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2024/11/msg00007.html