Description
A vulnerability was found in fapolicyd. The vulnerability occurs due to an assumption on how glibc names the runtime linker, a build time regular expression may not correctly detect the runtime linker. The consequence is that the pattern detection for applications launched by the run time linker may fail to detect the pattern and allow execution.
References (4)
Core 4
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=2068171
Permissions Required, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=2066904
Patch, Third Party Advisory x_refsource_misc
https://github.com/linux-application-whitelisting/fapolicyd/commit/38a942613f93824c53164730b2b7a2f75b8cd263
Third Party Advisory x_refsource_misc
https://access.redhat.com/security/cve/CVE-2022-1117
Scores
CVSS v3
8.4
EPSS
0.0015
EPSS Percentile
35.3%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-552
Status
published
Products (1)
fapolicyd_project/fapolicyd
< 1.1.2
Published
Aug 29, 2022
Tracked Since
Feb 18, 2026