CVE-2022-1117

HIGH

fapolicyd 1.1.2 - Runtime Linker Detection Bypass Allows Execution

Title source: manual
STIX 2.1

Description

A vulnerability was found in fapolicyd. The vulnerability occurs due to an assumption on how glibc names the runtime linker, a build time regular expression may not correctly detect the runtime linker. The consequence is that the pattern detection for applications launched by the run time linker may fail to detect the pattern and allow execution.

References (4)

Core 4
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=2068171
Permissions Required, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=2066904
Third Party Advisory x_refsource_misc
https://access.redhat.com/security/cve/CVE-2022-1117

Scores

CVSS v3 8.4
EPSS 0.0030
EPSS Percentile 21.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-552
Status published
Products (1)
fapolicyd_project/fapolicyd < 1.1.2
Published Aug 29, 2022
Tracked Since Feb 18, 2026