Vulnerability DatabaseCVE-2022-0896

CVE-2022-0896:
PHP vulnerability analysis and mitigation

Overview

The GNU C Library (glibc) through version 2.34 contains a stack-based buffer overflow vulnerability in the deprecated compatibility function clntcreate within the sunrpc module. The vulnerability was assigned CVE-2022-0896 and was disclosed in January 2022 ([Rapid7](https://www.rapid7.com/db/vulnerabilities/rockylinux-cve-2022-23219/)).

Technical details

The vulnerability occurs when the clntcreate function copies its hostname argument onto the stack without proper length validation. This implementation flaw can lead to a buffer overflow condition. The vulnerability has been assigned a CVSS score of 8.0, indicating a high severity level ([Rapid7](https://www.rapid7.com/db/vulnerabilities/rockylinux-cve-2022-23219/)).

Impact

If successfully exploited, this vulnerability could result in denial of service conditions or, in cases where applications are not built with stack protector enabled, could potentially lead to arbitrary code execution (Rapid7).

Mitigation and workarounds

Updates have been released to address this vulnerability. System administrators should apply the appropriate security updates for their glibc packages. For Red Hat Enterprise Linux 8, this was addressed in RHSA-2022:0896. After applying updates, all services linked to the glibc library must be restarted, or the system must be rebooted (Red Hat).