Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-23523

CVE-2022-23523: linux-loader reading beyond EOF could lead to infinite loop

1.9

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-23523
GHSA ID
GHSA-52h2-m2cf-9jh6
EPSS Score
0.04191%
CWE
CWE-119
Published
12/12/2022
Updated
1/31/2023
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
linux-loaderrust< 0.8.10.8.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from using read_from() with ELF-supplied offsets without validating against actual file size. The commit replaced these with read_exact(), which validates full reads. The affected code paths were: 1) ELF header parsing, 2) program header loop, and 3) note header processing. All three locations used the vulnerable read pattern and were directly modified in the security patch.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T** linux-lo***r *r*t* us** t** o**s*ts *n* siz*s provi*** in t** *L* *****rs to **t*rmin* t** o**s*ts to r*** *rom. I* t*os* o**s*ts point** **yon* t** *n* o* t** *il* t*is *oul* l*** to *n in*init* loop. Virtu*l M***in* Monitors usin* t*

Reasoning

T** vuln*r**ility st*mm** *rom usin* r***_*rom() wit* *L*-suppli** o**s*ts wit*out v*li**tin* ***inst **tu*l *il* siz*. T** *ommit r*pl**** t**s* wit* r***_*x**t(), w*i** v*li**t*s *ull r***s. T** *****t** *o** p*t*s w*r*: *) *L* *****r p*rsin*, *) p