Quick answers
- Is CVE-2022-40922 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2022-40922 being exploited in the wild.
- How severe is CVE-2022-40922?
- Low severity, with a CVSS score of 3.1, published 3 October 2022.
- Which products and versions are affected?
- lief (PyPI) ECOSYSTEM:introduced=0,fixed=0.12.2.
- Is there a fix for CVE-2022-40922?
- Yes. lief (PyPI): upgrade to 0.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2022-40922 attacked?
- It is attacked over the network.
- Am I affected by CVE-2022-40922?
- Check whether you run lief (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- lief (PyPI): upgrade to 0.12.2 or later
pip install "lief>=0.12.2"
Technical details
The vulnerability is a denial-of-service crash (segmentation fault) in the LIEF::MachO::BinaryParser::init_and_parse function when parsing malformed Mach-O files. The root cause involves improper validation of corrupted symbol table entries (nlist) with invalid string indices, leading to out-of-bounds memory access. An attacker can craft a malicious MachO file with corrupted nlist structures that, when parsed by LIEF v0.12.1 and earlier, triggers a write to invalid memory. This is a network-reachable remote DoS if LIEF is used in a service that accepts file uploads or network input. A patch is available in commit fde2c48986739fabd2cf9b40b9af149a89c57850, fixed in version 0.12.2.
Affected products
- LIEF Project LIEF 0.8.0 through 0.12.1
Identifiers
- CVE-2022-40922
- GHSA-38hf-c37x-32hv
- PYSEC-2022-43138
Timeline
- 2022-10-04: disclosed
- 2022-10-06: patched: Version 0.12.2 released with fix