CVE-2022-0563
MEDIUM
Published Feb 21, 20224y ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Published Feb 21, 2022 4y ago
Last Modified Jun 17, 2026 2w ago
Description
A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None
Threat Intelligence
No active exploitation signals — not in CISA KEV and no EPSS score yet.
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-209
Affected Products 2
References 3
- lore.kernel.org https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u
- security.gentoo.org https://security.gentoo.org/glsa/202401-08
- security.netapp.com https://security.netapp.com/advisory/ntap-20220331-0002/
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.