CVE-2022-4743: High severity libSDL Simple DirectMedia Layer vulnerability

Q: What is CVE-2022-4743?

CVE-2022-4743 is a potential memory leak issue in the SDL2 library in the GLES_CreateTexture() function in SDL_render_gles.c.

Q: What is the severity of CVE-2022-4743?

CVE-2022-4743 has a severity value of 7.5, which is considered high.

Q: Which software versions are affected by CVE-2022-4743?

SDL2 versions 2.0.4 and above are affected by CVE-2022-4743. SDL-1.x versions are not affected.

Q: How can an attacker exploit CVE-2022-4743?

An attacker can exploit CVE-2022-4743 to cause a denial of service attack.

Q: Is there a fix available for CVE-2022-4743?

Yes, SDL2 version 2.26.0 provides a fix for CVE-2022-4743.

Published Dec 26, 2022

Updated

A memory leak issue was discovered in SDL2 version >= SDL2-2.0.8

See the link below for details: https://github.com/libsdl-org/SDL/pull/6269 https://github.com/libsdl-org/SDL/commit/00b67f55727bc0944c3266e2b875440da132ce4b

Other sources

A potential memory leak issue was discovered in SDL2 in GLESCreateTexture() function in SDLrendergles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected.

Affected Software

8 affected componentsFixes available

redhat/sdl<2.26.0

2.26.0

redhat/sdl-prerelease<2.25.1

2.25.1

libSDL Simple DirectMedia Layer>=2.0.4<2.26.0

redhat Enterprise Linux=9.0

debian/libsdl2<2.26.0+dfsg-1

2.26.0+dfsg-1

debian/libsdl2<2.26.0+dfsg-1

2.26.0+dfsg-1

debian/libsdl2<2.26.0+dfsg-1

2.26.0+dfsg-1

debian/libsdl2

2.26.5+dfsg-12.32.4+dfsg-12.32.10+dfsg-8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/sdl to a version that resolves this vulnerability.
Fixed in 2.26.0
Upgrade
Upgrade redhat/sdl-prerelease to a version that resolves this vulnerability.
Fixed in 2.25.1
Upgrade
Upgrade debian/libsdl2 to a version that resolves this vulnerability.
Fixed in 2.26.5+dfsg-1Fixed in 2.32.4+dfsg-1Fixed in 2.32.10+dfsg-8
Upgrade
Upgrade debian/libsdl2 to a version that resolves this vulnerability.
Fixed in 2.26.0+dfsg-1

Event History

Jan 12, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·07:15 PM

DescriptionSeverityAffected Software

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2022-4743?

CVE-2022-4743 is a potential memory leak issue in the SDL2 library in the GLES_CreateTexture() function in SDL_render_gles.c.

What is the severity of CVE-2022-4743?

CVE-2022-4743 has a severity value of 7.5, which is considered high.

Which software versions are affected by CVE-2022-4743?

SDL2 versions 2.0.4 and above are affected by CVE-2022-4743. SDL-1.x versions are not affected.

How can an attacker exploit CVE-2022-4743?

An attacker can exploit CVE-2022-4743 to cause a denial of service attack.

Is there a fix available for CVE-2022-4743?

Yes, SDL2 version 2.26.0 provides a fix for CVE-2022-4743.

CVE-2022-4743: High severity libSDL Simple DirectMedia Layer vulnerability

Other sources

Affected Software

Remediation

Event History

Peer vulnerabilities

Frequently Asked Questions

What is CVE-2022-4743?

What is the severity of CVE-2022-4743?

Which software versions are affected by CVE-2022-4743?

How can an attacker exploit CVE-2022-4743?

Is there a fix available for CVE-2022-4743?

Company

Resources

Contact