CVE-2022-37347: 
NixOS vulnerability analysis and mitigation

Trend Micro Security 2021 and 2022 (Consumer) contains an Out-Of-Bounds Read Information Disclosure Vulnerability (CVE-2022-37347) that was discovered and disclosed on August 31, 2022. The vulnerability affects Trend Micro Maximum Security installations and could allow attackers to disclose sensitive information on affected systems (ZDI Advisory, Trend Micro).

The specific vulnerability exists within the User Mode Hooking Monitor Engine. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.1 base score of 4.4 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L), indicating medium severity (ZDI Advisory).

An attacker who successfully exploits this vulnerability could read sensitive information from other memory locations and cause a crash on an affected machine. The attacker can potentially leverage this vulnerability in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of SYSTEM (ZDI Advisory).

The vulnerability requires an attacker to first obtain the ability to execute low-privileged code on the target system. Trend Micro has reported no known instances of this vulnerability being exploited in the wild at the time of disclosure (Trend Micro).

Trend Micro has released an update via ActiveUpdate that resolves the vulnerability. Users should update to version 17.7.1634 of Trend Micro Security to address this issue (Trend Micro).