CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2022-2526

CVSS 9.8v3.1pub. 2022-09-09upd. 2024-11-21

A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Netapp Active Iq Unified Manager

    APP
    Netapp
    all versions

  • Netapp H300s

    HW
    Netapp
    all versions

  • Netapp H300s Firmware

    OS
    Netapp
    all versions

  • Netapp H410s

    HW
    Netapp
    all versions

  • Netapp H410s Firmware

    OS
    Netapp
    all versions

  • Netapp H500s

    HW
    Netapp
    all versions

  • Netapp H500s Firmware

    OS
    Netapp
    all versions

  • Netapp H700s

    HW
    Netapp
    all versions

  • Netapp H700s Firmware

    OS
    Netapp
    all versions

  • Systemd Project Systemd

    APP
    Systemd Project
    240
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Memory
CWE
References

Related vulnerabilities

CVE-2024-54085CRITICAL10.0⚠ KEVPL ✓same product

AMI MegaRAC SPx — zdalne ominięcie uwierzytelnienia w interfejsie Redfish BMC

CVE-2021-44228CRITICAL10.0⚠ KEVPL ✓same product

Apache Log4j2 Log4Shell — RCE przez podatną funkcję JNDI lookup

CVE-2024-40896CRITICAL9.1PL ✓same product

XXE w bibliotece libxml2 — obejście niestandardowych handlerów SAX

CVE-2024-52533CRITICAL9.8PL ✓same product

Buffer overflow w GNOME GLib — błąd off-by-one w obsłudze SOCKS4

CVE-2024-47561CRITICAL9.2PL ✓same product

Apache Avro Java SDK — RCE przez niebezpieczną deserializację schematu