VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 20 hours ago

CVE-2022-23218

9.8 Critical Out of RASP scope

Description

The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

CWE-120

Exploitation Status

Proof of concept only

A proof of concept exists, but no reviewed exploit catalogue carries this CVE. Demonstrating a defect and weaponising it are different amounts of work.

CVSS E:P

  • CISA KEV not listed
  • CISA Vulnrichment exploitation: poc CISA concluded an exploit has been demonstrated, typically from a vendor advisory, which leaves no artifact to index. Automatable: yes, technical impact: total.
  • Indexed PoC none indexed
  • EPSS 4.7% chance in 30 days

Waratek Defense Posture

Out of RASP scope

A genuine Java vulnerability in a supported product that the agent cannot reach: a coverage gap, not an out-of-domain finding.

  • Protection none
  • Action not-needed none
  • Review human manual-review
  • Record active
Decided by manual classification : Manual classification of this CVE in the legacy dataset
Finding Manual classification marked OUT-OF-SCOPE but CVE matches known CPE products

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 7.5 no band published AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected Software & Releases

🏛️ Oracle CPU Advisories & Products

AdvisoryTypeQuarterProducts Oracle named in risk matrix
Oracle Critical Patch Update October 2022 ↗ CPU 2022-Q4 Oracle Communications / Signaling (glibc) (22.1.1)

Indexed Oracle Components & Versions

FamilyComponentOracle's version cell (verbatim)Indexed as
Oracle Communications Signaling (glibc) 22.1.1 22.1.1

🖥️ Product CPEs & Version Ranges

4 product(s) over 6 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
nvd debian debian linux generic 10.0
nvd gnu glibc generic ＜ 2.31
nvd oracle communications cloud native core unified data repository generic 22.2.0
nvd oracle enterprise operations monitor generic 4.3 · 4.4 · 5.0

References

URLTags
https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202208-24 Third Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=28768 Exploit, Issue Tracking, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory

Timeline

Published 2022-01-14 Last modified 2026-06-17
Published2022-01-14By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.