Heap Buffer Overwrite Vulnerability in Finit Package
Summary
CVE-2025-32022: Finit provides fast init for Linux systems. Affects finit versions < 3feff37ba51fa0a6a0a06f59682a0918aa5b04de. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Finit is a fast init system for Linux that aims to provide a simple and efficient way to manage system services during boot. It is designed to be lightweight and user-friendly, making it a popular choice for various Linux distributions. However, a vulnerability has been identified in its urandom plugin, which is enabled by default in versions 4.2 and later, potentially affecting a wide range of users.
Vulnerability Detail
The vulnerability, identified as CVE-2025-32022, is a heap buffer overwrite issue in the urandom plugin of Finit. This flaw occurs during the boot process and can lead to the overwriting of other parts of the heap. The consequences may include random instabilities and undefined behavior in the system, which can compromise the stability and security of the affected Linux environment. This issue is particularly critical as it affects all users of Finit 4.2 or later who have not disabled the plugin at build time.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not possible, you can disable the urandom plugin by modifying the call to the 'configure' script as follows: './configure --disable-urandom'. This will prevent the plugin from being included in the build, mitigating the risk associated with the vulnerability.
Conclusion
The heap buffer overwrite vulnerability in the Finit package poses significant risks to system stability and security. Users are strongly advised to upgrade to the patched version or disable the vulnerable plugin to protect their systems. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your software.
See every vulnerability recorded for finit →
FAQ
CVE-2025-32022 is a vulnerability in the Finit package that allows for a heap buffer overwrite, potentially leading to system instability.
All versions of Finit from 4.2 and later are affected unless the urandom plugin is explicitly disabled during the build.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If upgrading is not an option, you should disable the urandom plugin during the build process to mitigate the risk.
Yes, the vulnerability has been fixed in Finit version 4.12. Users are encouraged to upgrade to this version.
Related vulnerabilities
Recent vulnerabilities recorded for finit.
