CVE-2022-44640: 
NixOS vulnerability analysis and mitigation

CVE-2022-44640 is a critical vulnerability discovered in Heimdal versions before 7.7.1, affecting the ASN.1 codec used by the Key Distribution Center (KDC). The vulnerability was disclosed on December 25, 2022, and allows remote attackers to execute arbitrary code due to an invalid free operation (MITRE CVE, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue stems from an invalid free operation in the ASN.1 codec specifically used by the Key Distribution Center (KDC) component (GitHub Advisory).

Successful exploitation of this vulnerability could lead to remote code execution on affected Heimdal KDC servers, potentially allowing attackers to execute arbitrary code with system privileges. The vulnerability affects confidentiality, integrity, and availability of the system, with high impact ratings across all three security metrics (Rapid7).

The primary mitigation is to upgrade to Heimdal version 7.7.1 or later. Various distributions have released security updates to address this vulnerability, including Ubuntu, Debian, and Gentoo. For Ubuntu systems, security updates are available for multiple versions including focal (20.04 LTS) and bionic (18.04 LTS) (Debian Security, Gentoo Security).