Skip to content
Fencer Intel
high 8.1

CVE-2022-24903 json

Buffer overflow in TCP syslog server (receiver) components in rsyslog

published 4y ago modified 4mo ago also EUVD-2022-29662

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.9%
EPSS 3.9% chance of exploitation in 30 days, percentile 90%
public exploits
0
none known

Summary

Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability can not be used for remote code execution. But there may still be a slight chance for experts to do that. The bug occurs when the octet count is read. While there is a check for the maximum number of octets, digits are written to a heap buffer even when the octet count is over the maximum, This can be used to overrun the memory buffer. However, once the sequence of digits stop, no additional characters can be added to the buffer. In our opinion, this makes remote exploits impossible or at least highly complex. Octet-counted framing is one of two potential framing modes. It is relatively uncommon, but enabled by default on receivers. Modules `imtcp`, `imptcp`, `imgssapi`, and `imhttp` are used for regular syslog message reception. It is best practice not to directly expose them to the public. When this practice is followed, the risk is considerably lower. Module `imdiag` is a diagnostics module primarily intended for testbench runs. We do not expect it to be present on any production installation. Octet-counted framing is not very common. Usually, it needs to be specifically enabled at senders. If users do not need it, they can turn it off for the most important modules. This will mitigate the vulnerability.

Patch / fix

  • rsyslog rsyslog 8.2204.1
  • rsyslog Debian 14, Debian 13, Debian 12 8.2204.1-1

debian advisories DEBIAN-CVE-2022-24903

  • rsyslog Ubuntu 18.04 LTS 8.32.0-1ubuntu4.2
  • rsyslog Ubuntu 20.04 LTS 8.2001.0-1ubuntu1.3
  • rsyslog Ubuntu 22.04 LTS 8.2112.0-2ubuntu2.2
  • rsyslog Ubuntu Pro 16.04 LTS 8.16.0-1ubuntu3.1+esm2

ubuntu advisories UBUNTU-CVE-2022-24903

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • redhat-virtualization-host rhev hypervisor 4.4 4.5.0-202205291010_8.6
  • redhat-virtualization-host-image-update rhev hypervisor 4.4 4.5.0-202205291010_8.6
  • redhat-virtualization-host RHEL 7 4.3.23-20220622.0.el7_9
  • redhat-virtualization-host-image-update RHEL 7 4.3.23-20220622.0.el7_9
  • rsyslog RHEL 9 8.2102.0-101.el9_0.1
  • rsyslog-relp RHEL 9 8.2102.0-101.el9_0.1
  • rsyslog-snmp RHEL 9 8.2102.0-101.el9_0.1
  • rsyslog-kafka RHEL 9 8.2102.0-101.el9_0.1

red hat advisories RHSA-2022:4896RHSA-2022:5439RHSA-2022:4808RHSA-2022:4795RHSA-2022:4799RHSA-2022:4800

  • rsyslog SLES 12 SP2-BCL 8.4.0-18.16.1
  • rsyslog SLES for SAP 12 SP4, SLES for SAP 12 SP3, SLES 12 SP4-LTSS +7 more 8.24.0-3.58.2
  • rsyslog SLES for SAP 12 SP5, SLES 12 SP5 8.2106.0-8.5.2
  • rsyslog SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +7 more 8.33.1-150000.3.37.1
  • rsyslog SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +10 more 8.2106.0-150200.4.26.1

suse advisories SUSE-SU-2022:2333-1SUSE-SU-2022:2331-1SUSE-SU-2022:2314-1SUSE-SU-2022:1817-1SUSE-SU-2022:1583-1

  • rsyslog openSUSE Tumbleweed 8.2204.1-1.1

opensuse advisories openSUSE-SU-2024:12059-1

  • rsyslog AlmaLinux 8 8.2102.0-7.el8
  • rsyslog-relp AlmaLinux 8 8.2102.0-7.el8
  • rsyslog-snmp AlmaLinux 8 8.2102.0-7.el8
  • rsyslog-kafka AlmaLinux 8 8.2102.0-7.el8
  • rsyslog-mysql AlmaLinux 8 8.2102.0-7.el8
  • rsyslog-pgsql AlmaLinux 8 8.2102.0-7.el8
  • rsyslog-crypto AlmaLinux 8 8.2102.0-7.el8
  • rsyslog-gnutls AlmaLinux 8 8.2102.0-7.el8

almalinux advisories ALSA-2022:4799

  • rsyslog Rocky Linux 8 8.2102.0-7.el8_6.1
  • rsyslog Rocky Linux 9 8.2102.0-101.el9_0.1

rocky linux advisories RLSA-2022:4799RLSA-2022:4795

  • rsyslog Alpine 3.12 8.2004.0-r2
  • rsyslog Alpine 3.14, Alpine 3.13 8.2012.0-r3
  • rsyslog Alpine 3.15 8.2108.0-r2
  • rsyslog Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 8.2204.1-r0

alpine advisories ALPINE-CVE-2022-24903

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rsyslog CBL-Mariner 2.0 8.2204.1-1

azure linux advisories AZL-9736

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2022-24903 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-24903 updated cvss 8.1

rsyslog: Heap-based overflow in TCP syslog server

  • Red Hat Enterprise Linux AppStream (v. 8) rsyslog 8.2102.0-7.el8_6.1, rsyslog-relp 8.2102.0-7.el8_6.1, rsyslog-snmp 8.2102.0-7.el8_6.1, rsyslog-kafka 8.2102.0-7.el8_6.1, rsyslog-mysql 8.2102.0-7.el8_6.1, rsyslog-pgsql 8.2102.0-7.el8_6.1, +13 more
    fixed: vendor fix RHSA-2022:4799
  • Red Hat Enterprise Linux AppStream (v. 9) rsyslog 8.2102.0-101.el9_0.1, rsyslog-relp 8.2102.0-101.el9_0.1, rsyslog-snmp 8.2102.0-101.el9_0.1, rsyslog-kafka 8.2102.0-101.el9_0.1, rsyslog-mysql 8.2102.0-101.el9_0.1, rsyslog-pgsql 8.2102.0-101.el9_0.1, +14 more
    fixed: vendor fix RHSA-2022:4795
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) rsyslog 8.37.0-13.el8_1.1, rsyslog-relp 8.37.0-13.el8_1.1, rsyslog-snmp 8.37.0-13.el8_1.1, rsyslog-kafka 8.37.0-13.el8_1.1, rsyslog-mysql 8.37.0-13.el8_1.1, rsyslog-pgsql 8.37.0-13.el8_1.1, +9 more
    fixed: vendor fix RHSA-2022:4801
  • Red Hat Enterprise Linux AppStream EUS (v. 8.2) rsyslog 8.1911.0-3.el8_2.1, rsyslog-relp 8.1911.0-3.el8_2.1, rsyslog-snmp 8.1911.0-3.el8_2.1, rsyslog-kafka 8.1911.0-3.el8_2.1, rsyslog-mysql 8.1911.0-3.el8_2.1, rsyslog-pgsql 8.1911.0-3.el8_2.1, +9 more
    fixed: vendor fix RHSA-2022:4800
  • Red Hat Enterprise Linux AppStream EUS (v.8.4) rsyslog 8.1911.0-7.el8_4.3, rsyslog-relp 8.1911.0-7.el8_4.3, rsyslog-snmp 8.1911.0-7.el8_4.3, rsyslog-kafka 8.1911.0-7.el8_4.3, rsyslog-mysql 8.1911.0-7.el8_4.3, rsyslog-pgsql 8.1911.0-7.el8_4.3, +11 more
    fixed: vendor fix RHSA-2022:4802
  • Red Hat Enterprise Linux Client (v. 7) rsyslog 8.24.0-57.el7_9.3, rsyslog-relp 8.24.0-57.el7_9.3, rsyslog-kafka 8.24.0-57.el7_9.3, rsyslog-gnutls 8.24.0-57.el7_9.3, rsyslog-gssapi 8.24.0-57.el7_9.3, rsyslog-mmjsonparse 8.24.0-57.el7_9.3 Red Hat Enterprise Linux Client Optional (v. 7) rsyslog-snmp 8.24.0-57.el7_9.3, rsyslog-mysql 8.24.0-57.el7_9.3, rsyslog-pgsql 8.24.0-57.el7_9.3, rsyslog-crypto 8.24.0-57.el7_9.3, rsyslog-libdbi 8.24.0-57.el7_9.3, rsyslog-mmaudit 8.24.0-57.el7_9.3, +5 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) rsyslog-snmp 8.24.0-57.el7_9.3, rsyslog-mysql 8.24.0-57.el7_9.3, rsyslog-pgsql 8.24.0-57.el7_9.3, rsyslog-crypto 8.24.0-57.el7_9.3, rsyslog-libdbi 8.24.0-57.el7_9.3, rsyslog-mmaudit 8.24.0-57.el7_9.3, +5 more
    fixed: vendor fix RHSA-2022:4803
  • Red Hat Enterprise Linux Server (v. 6 ELS) rsyslog 5.8.10-12.el6_10.1, rsyslog7 7.4.10-7.el6_10.1, rsyslog-relp 5.8.10-12.el6_10.1, rsyslog7-relp 7.4.10-7.el6_10.1, rsyslog-mysql 5.8.10-12.el6_10.1, rsyslog-pgsql 5.8.10-12.el6_10.1, +6 more
    fixed: vendor fix RHSA-2022:4808
  • Red Hat Enterprise Linux Server (v. 7) rsyslog 8.24.0-57.el7_9.3, rsyslog-relp 8.24.0-57.el7_9.3, rsyslog-kafka 8.24.0-57.el7_9.3, rsyslog-mysql 8.24.0-57.el7_9.3, rsyslog-pgsql 8.24.0-57.el7_9.3, rsyslog-gnutls 8.24.0-57.el7_9.3, +2 more
    fixed: vendor fix RHSA-2022:4803
show 8 more
  • Red Hat Enterprise Linux Server Optional (v. 6 ELS) rsyslog-snmp 5.8.10-12.el6_10.1, rsyslog7-snmp 7.4.10-7.el6_10.1, rsyslog7-elasticsearch 7.4.10-7.el6_10.1
    fixed: vendor fix RHSA-2022:4808
  • Red Hat Enterprise Linux Server Optional (v. 7) rsyslog-snmp 8.24.0-57.el7_9.3, rsyslog-crypto 8.24.0-57.el7_9.3, rsyslog-libdbi 8.24.0-57.el7_9.3, rsyslog-mmaudit 8.24.0-57.el7_9.3, rsyslog-udpspoof 8.24.0-57.el7_9.3, rsyslog-mmjsonparse 8.24.0-57.el7_9.3, +4 more Red Hat Enterprise Linux Workstation (v. 7) rsyslog 8.24.0-57.el7_9.3, rsyslog-relp 8.24.0-57.el7_9.3, rsyslog-kafka 8.24.0-57.el7_9.3, rsyslog-mysql 8.24.0-57.el7_9.3, rsyslog-pgsql 8.24.0-57.el7_9.3, rsyslog-gnutls 8.24.0-57.el7_9.3, +2 more Red Hat Enterprise Linux Workstation Optional (v. 7) rsyslog-snmp 8.24.0-57.el7_9.3, rsyslog-crypto 8.24.0-57.el7_9.3, rsyslog-libdbi 8.24.0-57.el7_9.3, rsyslog-mmaudit 8.24.0-57.el7_9.3, rsyslog-udpspoof 8.24.0-57.el7_9.3, rsyslog-mmnormalize 8.24.0-57.el7_9.3, +3 more
    fixed: vendor fix RHSA-2022:4803
  • Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host 4.3.23-20220622.0.el7_9, redhat-virtualization-host-image-update 4.3.23-20220622.0.el7_9
    fixed: vendor fix RHSA-2022:5439
  • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host 4.5.0-202205291010_8.6, redhat-virtualization-host-image-update 4.5.0-202205291010_8.6
    fixed: vendor fix RHSA-2022:4896
  • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts rsyslog 8.24.0-57.el7_9.3, rsyslog-mmjsonparse 8.24.0-57.el7_9.3, rsyslog-mmnormalize 8.24.0-57.el7_9.3, rsyslog-elasticsearch 8.24.0-57.el7_9.3
    fixed: vendor fix RHSA-2022:4803
  • Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-virtualization-host 4.3.23-20220622.0.el7_9, redhat-virtualization-host-image-update 4.3.23-20220622.0.el7_9
    fixed: vendor fix RHSA-2022:5439
  • Red Hat RHV-M 4.3 rsyslog-mmnormalize 8.24.0-57.el7_9.3, rsyslog-elasticsearch 8.24.0-57.el7_9.3
    fixed: vendor fix RHSA-2022:4803
  • Red Hat Virtualization 4 Hypervisor for RHEL 8 elfutils 0.186-1.el8, elfutils-debuginfod-client 0.186-1.el8 Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-release-virtualization-host 4.3.23-1.el7ev, redhat-virtualization-host-productimg 4.3.23-1.el7, redhat-virtualization-host-image-update-placeholder 4.3.23-1.el7ev Red Hat RHEL 8-based RHEV-H for RHEV 4 (build requirements) imgbased 1.2.24-1.el8ev, ovirt-node-ng 4.4.2-1.el8ev, python3-imgbased 1.2.24-1.el8ev, ovirt-node-ng-nodectl 4.4.2-1.el8ev, python3-ovirt-node-ng-nodectl 4.4.2-1.el8ev, redhat-release-virtualization-host 4.5.0-5.el8ev, +3 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-194-01 updated cvss 8.1

Siemens RUGGEDCOM ROX

  • Siemens RUGGEDCOM ROX MX5000 <V2.16.0 Siemens RUGGEDCOM ROX MX5000RE <V2.16.0 Siemens RUGGEDCOM ROX RX1400 <V2.16.0 Siemens RUGGEDCOM ROX RX1500 <V2.16.0 Siemens RUGGEDCOM ROX RX1501 <V2.16.0 Siemens RUGGEDCOM ROX RX1510 <V2.16.0
    +5 more products
    Siemens RUGGEDCOM ROX RX1511 <V2.16.0 Siemens RUGGEDCOM ROX RX1512 <V2.16.0 Siemens RUGGEDCOM ROX RX1524 <V2.16.0 Siemens RUGGEDCOM ROX RX1536 <V2.16.0 Siemens RUGGEDCOM ROX RX5000 <V2.16.0
    affected: fixed in V2.16.0 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
last yr.

Exploit prediction

3.95% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • rsyslog rsyslog

Classification

Weakness
  • CWE-120 Buffer Copy without Checking Size of Input
  • CWE-1284 Improper Validation of Specified Quantity in Input

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.