CVE-2022-44940: 
Python vulnerability analysis and mitigation

Patchelf v0.9 was discovered to contain an out-of-bounds read vulnerability (CVE-2022-44940) in the function modifyRPath located at src/patchelf.cc. The vulnerability was discovered and reported in November 2022, affecting multiple versions of the PatchELF utility, which is used to modify properties of ELF executables (NVD, CVE Mitre).

The vulnerability stems from improper bounds checking in the modifyRPath function, which could lead to an out-of-bounds read when processing specially crafted files. The issue was confirmed through Address Sanitizer (ASAN) testing, which revealed a segmentation fault caused by a read memory access at an invalid address (GitHub PR).

If exploited, this vulnerability could potentially lead to a denial of service condition or the exposure of sensitive information when processing maliciously crafted files (Ubuntu Notice).

The vulnerability has been addressed in subsequent versions of PatchELF. Ubuntu has released security updates for affected versions: Ubuntu 22.10 users should update to patchelf version 0.14.3-1ubuntu0.1, and Ubuntu 22.04 users should update to version 0.14.3-1ubuntu0.1~esm1 (Ubuntu Notice).