CVE-2022-35064: 
NixOS vulnerability analysis and mitigation

OTFCC commit 617837b contains a heap buffer overflow vulnerability (CVE-2022-35064) that affects the /release-x64/otfccdump+0x4adcdb functionality in __asan_memset. The vulnerability was discovered in 2022 and affects OTFCC project software versions from that period (NVD).

The vulnerability is classified as a heap buffer overflow (CWE-787: Out-of-bounds Write) with a CVSS v3.1 base score of 6.5 (Medium), and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. This indicates that the vulnerability is network exploitable, requires low attack complexity, needs no privileges, but does require user interaction (NVD).

The heap buffer overflow vulnerability can lead to memory corruption and potential arbitrary code execution. The CVSS scoring indicates that while confidentiality and integrity impacts are not present, there is a high impact on availability, suggesting the vulnerability could be exploited to cause system crashes or denial of service (NVD).

The vulnerability has been documented with proof-of-concept code available, indicating active research into its exploitation. The attack vector is network-accessible but requires user interaction to exploit (NVD, GitHub PoC).

The vulnerability has been marked as fixed in certain distributions, such as in the Debian bullseye release, while remaining vulnerable in newer versions like bookworm, trixie, and sid (Debian Tracker). Users are advised to update to patched versions where available.