CVE-2022-29503 - A memory corruption vulnerability exists in the libpthread linuxthreads functionality of uClibC 0.9.33.2 and uClibC-ng 1.0.40

Back Back to CVE browser

CRITICAL

A memory corruption vulnerability exists in the libpthread linuxthreads functionality of uClibC 0.9.33.2 and uClibC-ng 1.0.40

Published Sep 29, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 1.31%

Description

A memory corruption vulnerability exists in the libpthread linuxthreads functionality of uClibC 0.9.33.2 and uClibC-ng 1.0.40. Thread allocation can lead to memory corruption. An attacker can create threads to trigger this vulnerability.

Affected products

Vendor Anker Product Eufy Homebase 2 Default
n/a
- Version
  2.1.8.8h
  Status
  affected
  Constraints
  -
Vendor uClibC Product uClibC Default
n/a
- Version
  0.9.33.2
  Status
  affected
  Constraints
  -
Vendor uClibC-ng Product uClibC-ng Default
n/a
- Version
  1.0.40
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Anker

Eufy Homebase 2

n/a

Version	Status	Constraints
2.1.8.8h	affected	-

uClibC

n/a

Version	Status	Constraints
0.9.33.2	affected	-

uClibC-ng

n/a

Version	Status	Constraints
1.0.40	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-770

Allocation of Resources Without Limits

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-33840
Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1517
ExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-33840		Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1517		ExploitThird Party Advisory