CVE-2022-22888: 
NixOS vulnerability analysis and mitigation

Jerryscript 3.0.0 contains a stack overflow vulnerability (CVE-2022-22888) discovered in the ecma_op_object_find_own function located in /ecma/operations/ecma-objects.c. The vulnerability was identified and disclosed on January 20, 2022 (NVD).

The vulnerability is a stack overflow condition that occurs in the ecma_op_object_find_own function. The issue manifests when processing certain JavaScript objects, potentially leading to recursive calls that exhaust the stack. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

The vulnerability can lead to a stack overflow condition, which could result in program crashes and potential arbitrary code execution. The CVSS scoring indicates high impacts on confidentiality, integrity, and availability when successfully exploited (NVD).

The vulnerability requires local access and user interaction to be exploited. A proof-of-concept exploit has been published that demonstrates the stack overflow using a specific JavaScript test case involving array manipulation and JSON parsing (GitHub Issue).

The vulnerability affects JerryScript version 3.0.0. Users should update to a patched version of the software when available. The issue was reported and tracked through the project's GitHub repository (GitHub Issue).