CVE-2022-27239
High
Description
In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges.
SeverityHigh
CVSS7.8
Exploit probability—
Product
Samba Cifs-utils
PublishedApr 27, 2022
First seenApr 27, 2022
How to fix
Update
- samba cifs-utils6.15 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIYZ4L6SLSYJQ446VJAO2VGAESURQNSP/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXKZLJYJJEC3TIBFLXUORRMZUKG5W676/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5WBOLMANBYJILXQKRRK7OCR774PXJAYY/
- debian.org/security/2022/dsa-5157
- security.gentoo.org/glsa/202311-05
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| samba cifs-utils | v < 6.15 | 6.15 |
| debian debian_linux | 9.0, 10.0, 11.0 | — |
| suse caas_platform | 4.0 | — |
| suse enterprise_storage | 6.0, 7.0 | — |
| suse linux_enterprise_point_of_service | 11.0 | — |
| suse linux_enterprise_storage | 7.1 | — |
| suse manager_proxy | 4.1, 4.2, 4.3 | — |
| suse manager_retail_branch_server | 4.1, 4.2, 4.3 | — |
| suse manager_server | 4.1, 4.2, 4.3 | — |
| suse openstack_cloud | 8.0, 9.0 | — |
| suse openstack_cloud_crowbar | 8.0, 9.0 | — |
| suse linux_enterprise_desktop | 15 | — |
| suse linux_enterprise_high_performance_computing | 12.0, 15.0 | — |
| suse linux_enterprise_micro | 5.2 | — |
| suse linux_enterprise_real_time | 15.0 | — |
| suse linux_enterprise_server | 11, 12, 15 | — |
| suse linux_enterprise_software_development_kit | 12 | — |
| hp helion_openstack | 8.0 | — |
| fedoraproject fedora | 34, 35, 36 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.