CVE-2022-4415

systemd: local information leak due to systemd-coredump not respecting fs.suid_dumpable kernel setting

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.

*Credits: N/A

CVSS Scores

NISTv3.1 5.5

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-12-12 CVE Reserved
2023-01-11 CVE Published
2024-08-03 CVE Updated
2024-08-03 EPSS Updated
2024-08-03 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CAPEC

References (4)

URL	Tag	Source
https://www.openwall.com/lists/oss-security/2022/12/21/3	Mailing List

URL	Date	SRC
https://github.com/systemd/systemd/commit/b7641425659243c09473cd8fb3aef2c0d4a3eb9c	2024-08-03

URL	Date	SRC

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2022-4415	2024-03-05
https://bugzilla.redhat.com/show_bug.cgi?id=2155515	2024-03-05

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Systemd Project Search vendor "Systemd Project"		Systemd Search vendor "Systemd Project" for product "Systemd"				>= 246 < 253 Search vendor "Systemd Project" for product "Systemd" and version " >= 246 < 253"		-		Affected