Privilege Escalation Vulnerability in util-linux: CVE-2022-0563
Summary
ALPINE-CVE-2022-0563: A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. Affects util-linux versions < 2.37.4-r0. Fixed in 2.37.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
util-linux is a standard package that provides essential utilities for Linux systems, including tools for managing filesystems, system processes, and user accounts. It is widely used across various Linux distributions, including Alpine Linux. The package is crucial for system administration tasks and user management. However, a vulnerability has been identified in the chfn and chsh utilities when compiled with Readline support, which could potentially allow unprivileged users to escalate their privileges.
Vulnerability Detail
A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library utilizes an 'INPUTRC' environment variable to specify a path to its configuration file. If the library fails to parse the specified file, it outputs an error message that may contain sensitive data from the file. This flaw allows unprivileged users to read root-owned files, which could lead to privilege escalation. The vulnerability affects util-linux versions prior to 2.37.4.
How To Fix
Minimum fixed version
2.37.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade util-linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can unset the INPUTRC environment variable to prevent the Readline library from attempting to read a potentially malicious configuration file. This can be done by executing the following command in your terminal: unset INPUTRC.
Conclusion
CVE-2022-0563 is a significant vulnerability in the util-linux package that can lead to privilege escalation for unprivileged users. It is crucial to update to the patched version (2.37.4 or later) to mitigate this risk. Additionally, using the Vulert platform can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for util-linux →
FAQ
CVE-2022-0563 is a vulnerability in the util-linux package that allows unprivileged users to read root-owned files, potentially leading to privilege escalation.
All versions of util-linux prior to 2.37.4 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2022-0563 is 5.5, indicating a moderate level of severity.
If you cannot update the package immediately, consider unsetting the INPUTRC environment variable as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for util-linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
