← Back to CVEs
CVE-2022-36227
CRITICAL9.8
Description
In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution."
CVE Details
CVSS v3.1 Score9.8
SeverityCRITICAL
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack VectorNETWORK
ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
Published11/22/2022
Last Modified11/3/2025
Sourcenvd
Honeypot Sightings0
Affected Products
debian:debian_linuxfedoraproject:fedoralibarchive:libarchivesplunk:universal_forwarder
Weaknesses (CWE)
CWE-476
References
https://bugs.gentoo.org/882521(cve@mitre.org)
https://github.com/libarchive/libarchive/blob/v3.0.0a/libarchive/archive_write.c#L215(cve@mitre.org)
https://github.com/libarchive/libarchive/issues/1754(cve@mitre.org)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V67OO2UUQAUJS3IK4JZPF6F3LUCBU6IS/(cve@mitre.org)
https://security.gentoo.org/glsa/202309-14(cve@mitre.org)
https://bugs.gentoo.org/882521(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/libarchive/libarchive/blob/v3.0.0a/libarchive/archive_write.c#L215(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/libarchive/libarchive/issues/1754(af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2023/01/msg00034.html(af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2024/11/msg00007.html(af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V67OO2UUQAUJS3IK4JZPF6F3LUCBU6IS/(af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/202309-14(af854a3a-2127-422b-91ae-364da2661108)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.