Back to feed
EUVD-2022-28308 · Published Jan 14, 2022
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
Technologies
Oracle Communications Cloud Native Core Network Repository FunctionOracle Enterprise Operations MonitorGnu GlibcOracle Communications Cloud Native Core Network Function Cloud Native EnvironmentOracle Communications Cloud Native Core Binding Support FunctionDebian Debian LinuxOracle Communications Cloud Native Core Unified Data RepositoryOracle Communications Cloud Native Core Security Edge Protection Proxy
Weaknesses
CWE-120
CVSS scores
- v3.19.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - v2.07.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
Potentially impacted assets
See if this affects your attack surface
