SUSE update for rsyslog

1) Heap-based buffer overflow

EUVDB-ID: #VU62830

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-24903

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service or potentially execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when parsing data in imtcp, imptcp, imgssapi, and imhttp modules used for TCP syslog reception. A remote attacker can pass specially crafted data to the application, trigger heap-based buffer overflow and cause a denial of service or potentially execute arbitrary code on the target system.

Successful exploitation of this vulnerability is possible if the attacker is able to directly send specially crafted messages to the rsyslog daemon or by injecting specially crafted data into log files. Vulnerability exploitation in the second scenario requires that the rsyslog client supports octet-counted framing, which is not a default configuration.

Mitigation

Update the affected package rsyslog to the latest version.

Vulnerable software versions

SUSE OpenStack Cloud Crowbar: 8 - 9

SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4

HPE Helion Openstack: 8

SUSE Linux Enterprise Server: 12-SP3-BCL - 12-SP4-LTSS

SUSE OpenStack Cloud: 8 - 9

rsyslog-module-udpspoof-debuginfo: before 8.24.0-3.58.2

rsyslog-module-udpspoof: before 8.24.0-3.58.2

rsyslog-module-snmp-debuginfo: before 8.24.0-3.58.2

rsyslog-module-snmp: before 8.24.0-3.58.2

rsyslog-module-relp-debuginfo: before 8.24.0-3.58.2

rsyslog-module-relp: before 8.24.0-3.58.2

rsyslog-module-pgsql-debuginfo: before 8.24.0-3.58.2

rsyslog-module-pgsql: before 8.24.0-3.58.2

rsyslog-module-mysql-debuginfo: before 8.24.0-3.58.2

rsyslog-module-mysql: before 8.24.0-3.58.2

rsyslog-module-mmnormalize-debuginfo: before 8.24.0-3.58.2

rsyslog-module-mmnormalize: before 8.24.0-3.58.2

rsyslog-module-gtls-debuginfo: before 8.24.0-3.58.2

rsyslog-module-gtls: before 8.24.0-3.58.2

rsyslog-module-gssapi-debuginfo: before 8.24.0-3.58.2

rsyslog-module-gssapi: before 8.24.0-3.58.2

rsyslog-doc: before 8.24.0-3.58.2

rsyslog-diag-tools-debuginfo: before 8.24.0-3.58.2

rsyslog-diag-tools: before 8.24.0-3.58.2

rsyslog-debugsource: before 8.24.0-3.58.2

rsyslog-debuginfo: before 8.24.0-3.58.2

rsyslog: before 8.24.0-3.58.2

CPE2.3

• cpe:2.3:o:suse:suse_openstack_cloud_crowbar:8:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_openstack_cloud_crowbar:9:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:hpe_helion_openstack:8:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-BCL:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_openstack_cloud:8:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_openstack_cloud:9:*:*:*:*:*:*:*
• cpe:2.3:a:suse:rsyslog-module-udpspoof-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:rsyslog-module-udpspoof:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:rsyslog-module-snmp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:rsyslog-module-snmp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:rsyslog-module-relp-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:rsyslog-module-relp:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:rsyslog-module-pgsql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:rsyslog-module-pgsql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:rsyslog-module-mysql-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:rsyslog-module-mysql:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:rsyslog-module-mmnormalize-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:rsyslog-module-mmnormalize:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:rsyslog-module-gtls-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:rsyslog-module-gtls:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:rsyslog-module-gssapi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:rsyslog-module-gssapi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:rsyslog-doc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:rsyslog-diag-tools-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:rsyslog-diag-tools:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:rsyslog-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:rsyslog-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:rsyslog:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20222331-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.