CVE-2022-0563: 
NixOS vulnerability analysis and mitigation

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support, identified as CVE-2022-0563. The vulnerability was discovered in February 2022 and affects util-linux versions prior to 2.37.4. The issue stems from the Readline library's use of the 'INPUTRC' environment variable to get a path to the library config file (Kernel Mailing List).

The vulnerability occurs when the Readline library cannot parse the specified config file, causing it to print an error message containing data from the file. The issue has a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified under CWE-209 (Generation of Error Message Containing Sensitive Information) (NVD Database).

This vulnerability allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. The exploitation is particularly concerning when chfn(8) is used with enabled CHFN_RESTRICT setting in /etc/login.defs, though this setting may be disabled by default (Kernel Mailing List).

The vulnerability was fixed in util-linux version 2.37.4. Users and organizations are advised to upgrade to this version or later to mitigate the vulnerability. The fix was released as part of the util-linux v2.37.4 update (Kernel Mailing List, Gentoo Security).