CVE-2022-37451
Published: 06 August 2022
Summary
CVE-2022-37451 is a high-severity Release of Invalid Pointer or Reference (CWE-763) vulnerability in Fedoraproject Fedora. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 4.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Exim before version 4.96 contains an invalid free vulnerability in the pam_converse function within auths/call_pam.c. The issue stems from a mismatched allocation pattern in which store_malloc is used without a corresponding store_free call, triggering CWE-763. This affects the Exim mail transfer agent when it is built with PAM authentication support.
A remote unauthenticated attacker can trigger the flaw over the network by supplying input that exercises the PAM conversation path during authentication. Successful exploitation leads to memory corruption that crashes the Exim process, producing a denial-of-service condition with high availability impact as reflected in the CVSS 7.5 score.
The official fix is included in Exim 4.96; the project’s security page and the commit that replaces the incorrect free with store_free document the required upgrade. Administrators should apply the patch or later release and verify that PAM-enabled builds are updated.
A publicly available proof-of-concept exists, and the CVE maintains an EPSS score near 0.19, indicating sustained but not sharply escalating exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-40077
Vulnerability details
Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.