External risk intelligence

glibc sunrpc Buffer Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-23218

The vulnerability exists in a low-level library function (sunrpc) within the GNU C Library. While the library itself is ubiquitous, this specific deprecated function is rarely exposed directly to the public internet in common application deployments. Most applications utilizing such libraries do so within internal service architectures or behind application logic that limits direct network exposure to this specific component.

Buffer Overflow

Gnu Glibc

before 2.3122.2.04.34.45.010.0

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the GNU C Library, specifically within a deprecated function handling network connections, could allow for unauthorized code execution or service disruption. This issue stems from a failure to properly manage data length, leading to a potential buffer overflow. The main concern is confirming if this deprecated function is actively used within our environment.

Library flaw allows code execution or service disruption.
Check if deprecated network function is used.
Assess exposure of this specific library component.

Attack Path

How an attacker could exploit the issue

An attacker could target a system running a vulnerable version of the GNU C Library by sending specially crafted network requests to an application that utilizes the deprecated `svcunix_create` function. This function, found in the sunrpc module, copies a path argument onto the stack without checking its size, potentially leading to a buffer overflow. If the application lacks stack protection, this overflow could allow an attacker to execute arbitrary code or cause a denial of service.

No specific access required.
Triggered by network requests.
Leads to code execution or denial of service.

Live Threat

Current exploitation, exposure, and threat context

The deprecated `svcunix_create` function in the GNU C Library (glibc) could allow an attacker to cause a buffer overflow. This vulnerability could lead to a denial of service or, in some configurations, arbitrary code execution.

System libraries and running applications.
Network input to a vulnerable function.
Potential for service disruption or code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for the GNU C Library (glibc) or systems running it, such as infrastructure or platform engineering, must first identify all deployments of glibc. Confirming network reachability and business criticality of affected systems will prioritize remediation efforts, guiding the accountable owner to plan updates within a maintenance window.

Infrastructure or platform owners should manage this.
Verify system reachability and business criticality first.
Plan updates or risk reduction measures.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the GNU C Library and its role in software?

The GNU C Library, or glibc, acts as the fundamental building block for Linux-based systems. It provides essential low-level functions that applications use to interact with the operating system, handle memory, and manage network communications. Because almost every program on a Linux system relies on it, issues within the library have wide-reaching implications for how software behaves and remains secure.

How does CVE-2022-23218 create a buffer overflow?

This vulnerability involves a weakness class known as CWE-120, which relates to classic buffer handling errors. Specifically, the deprecated svcunix_create function fails to verify the length of a path string before copying it into a fixed-size memory area on the stack. When an oversized input is provided, it overwrites adjacent memory, which can disrupt the program or allow an attacker to hijack the application's execution flow.

When does this vulnerability trigger?

The issue is triggered when an application calls the deprecated svcunix_create function while processing a malicious network request containing an excessively long path argument. Importantly, if an application does not utilize this specific older function, or if the underlying system environment has modern stack protections enabled, the risk of successful arbitrary code execution is significantly mitigated.

Do I need to worry about internet-facing services?

While the vulnerability is network-reachable, Halo Surface Signal notes that this specific deprecated function is rarely exposed directly to the public internet. Most modern services do not use this component in a way that allows external attackers to reach it. You should prioritize assets where internal or external application logic might inadvertently pass untrusted network data to this deprecated library component.

What is the recommended first step for remediation?

The priority is to locate all instances of glibc within your infrastructure to see which versions are active. Since this is a core system library, updating it often requires coordination with platform or infrastructure teams to plan maintenance windows. Focus on identifying which applications in your environment are actually making calls to the sunrpc module, as this determines the true risk for your specific stack.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.