CVE-2022-3116: 
NixOS vulnerability analysis and mitigation

The Heimdal Software Kerberos 5 implementation contains a vulnerability identified as CVE-2022-3116, which was discovered and disclosed in October 2022. This vulnerability affects Heimdal versions through 7.7.0 and involves a null pointer dereference in the SPNEGO implementation. The vulnerability specifically exists in the lib/gssapi/spnego/accept_sec_context.c component (CERT Advisory).

The vulnerability stems from a flawed logical condition in lib/gssapi/spnego/accept_sec_context.c that can be triggered using a crafted negTokenInit token. The severity of this vulnerability has been assessed with a CVSS v3.1 Base Score of 7.5 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. This scoring indicates that the vulnerability can be exploited remotely with low attack complexity, requires no privileges or user interaction, and primarily impacts system availability (NVD).

When successfully exploited, this vulnerability allows an attacker with network access to an application that depends on the vulnerable code path to cause the application to crash, resulting in a Denial of Service (DoS) condition. The impact is limited to availability, with no direct effect on confidentiality or integrity of the system (CERT Advisory).

The vulnerability has been fixed in the Heimdal master branch through commit 7a19658c1f4fc4adf85bb7bea96caae5ba57b33e ("spnego: Fix NULL deref"). While the current stable release 7.7.0 remains vulnerable, various distributions have backported the fix. Ubuntu has released security updates for multiple versions, including fixes for 20.04 LTS (7.7.0+dfsg-1ubuntu1.1) and 18.04 LTS (7.5.0+dfsg-1ubuntu0.1) (Ubuntu Security).