CVE-2022-40154: Buffer Overflow

Reference Links

• https://exchange.xforce.ibmcloud.com/vulnerabilities/236357
• https://www.ibm.com/support/pages/node/6846257 (Advisory)
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50393
• https://github.com/x-stream/xstream/issues/304
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2128960
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2128961
• https://access.redhat.com/errata/RHSA-2023:0469
• https://access.redhat.com/security/cve/cve-2022-40154
• https://bugzilla.redhat.com/show_bug.cgi?id=2128959
• https://www.cve.org/CVERecord?id=CVE-2022-40154 https://nvd.nist.gov/vuln/detail/CVE-2022-40154

Parent vulnerabilities

(Appears in the following advisories)

• RHSA-2023:0469
• IBM-6846257

Frequently Asked Questions

• What is CVE-2022-40154?

  CVE-2022-40154 is a vulnerability in the XStream package that allows a remote authenticated attacker to cause a denial of service by exploiting a stack-based buffer overflow.

• What is the severity of CVE-2022-40154?

  CVE-2022-40154 has a severity rating of high.

• How does CVE-2022-40154 impact IBM Disconnected Log Collector?

  IBM Disconnected Log Collector versions v1.0 to v1.8.2 are affected by CVE-2022-40154 and can be exploited to cause a denial of service condition.

• Is there a fix for CVE-2022-40154?

  A fix for CVE-2022-40154 may be available from the vendor. It is recommended to check with IBM for any available patches or updates.

• Where can I find more information about CVE-2022-40154?

  More information about CVE-2022-40154 can be found in the references provided: CVE-2022-40154 on Chromium Bug Tracker, XStream GitHub issue #304, and Red Hat Bugzilla #2128960.