← Vulnerability feed

Vulnerability record · CVE-2022-39046 · published 31 August 2022

CVE-2022-39046: Gnu glibc sensitive information in log file vulnerability

Gnu · Glibc

An issue was discovered in the GNU C Library (glibc) 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitialized memory from the heap and prints it to the target log file, potentially revealing a portion of the contents of the heap.

5.3 CVSS 3.1 Medium EPSS 1.8% · top 22.1% CWE-532 · Sensitive information in log file
5.3CVSS 3.1 base score
1.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
7Affected product versions listed by NVD
14References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

An issue was discovered in the GNU C Library (glibc) 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitialized memory from the heap and prints it to the target log file, potentially revealing a portion of the contents of the heap.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

7 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html
http://seclists.org/fulldisclosure/2024/Feb/3
http://www.openwall.com/lists/oss-security/2024/01/30/6
http://www.openwall.com/lists/oss-security/2024/01/30/8
https://security.gentoo.org/glsa/202310-03 Third Party Advisory
https://security.netapp.com/advisory/ntap-20221104-0002/ Third Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=29536 ExploitIssue TrackingThird Party Advisory
http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html
http://seclists.org/fulldisclosure/2024/Feb/3
http://www.openwall.com/lists/oss-security/2024/01/30/6
http://www.openwall.com/lists/oss-security/2024/01/30/8
https://security.gentoo.org/glsa/202310-03 Third Party Advisory
https://security.netapp.com/advisory/ntap-20221104-0002/ Third Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=29536 ExploitIssue TrackingThird Party Advisory

Track CVE-2022-39046 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2024-54085AMI MegaRAC SPx BMC authentication bypass via Redfish Host InterfaceAMI's SPx BMC implementation contains an authentication bypass reachable remotely through the Redfish Host Interface, classified as CWE-290 (authenti…KEVEPSS 61%analysed8.4CVE-2022-0185Linux Kernel Filesystem Context Heap Buffer OverflowThe legacy_parse_param function in the Linux kernel's Filesystem Context functionality fails to properly verify supplied parameter lengths, causing a…KEVEPSS 25%analysed7.8CVE-2024-1086Linux kernel nf_tables use-after-free allows local privilege escalationThe Linux kernel's netfilter nf_tables component has a use-after-free in nft_verdict_init(), where positive drop errors are accepted and nf_hook_slow…KEVEPSS 28%analysed7.8CVE-2023-4911GNU C Library ld.so GLIBC_TUNABLES heap buffer overflowThe GNU C Library dynamic loader ld.so mishandles the GLIBC_TUNABLES environment variable, causing a heap-based buffer overflow and out-of-bounds wri…KEVEPSS 64%analysed7.8CVE-2023-0386Linux kernel OverlayFS setuid copy privilege escalationA uid mapping bug in the Linux kernel OverlayFS subsystem lets a local user copy a file with capabilities from a nosuid mount into another mount, byp…KEVEPSS 7.9%analysed7.8CVE-2022-0995Linux kernel watch_queue out-of-bounds writeThe Linux kernel's watch_queue event notification subsystem contains an out-of-bounds write (CWE-787) that can overwrite kernel state. A local user c…KEVEPSS 8.8%analysed7.8CVE-2022-0847Linux kernel pipe buffer flaw allows local privilege escalationThe flags member of the new pipe buffer structure was not properly initialized in copy_page_to_iter_pipe and push_pipe, so it could hold stale values…KEVEPSS 93%analysed7.8CVE-2022-0492Linux kernel cgroups v1 release_agent privilege escalation and container escapeThe Linux kernel's cgroup_release_agent_write in kernel/cgroup/cgroup-v1.c mishandles authorization, letting the cgroups v1 release_agent feature be …KEVEPSS 5.5%analysed

Source: NIST National Vulnerability Database (record CVE-2022-39046), CISA KEV, FIRST EPSS (scores of 2026-10-11). This page is refreshed as NVD updates the record.