{"id":"CVE-2022-45873","details":"systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology is to crash a binary calling the same function recursively, and put it in a deeply nested directory to make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16 is set for the systemd/units/systemd-coredump.socket file.","modified":"2026-08-03T14:27:40.333375Z","published":"2022-11-23T00:00:00Z","related":["ALSA-2023:0954"],"database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/45xxx/CVE-2022-45873.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/45xxx/CVE-2022-45873.json"},{"type":"ADVISORY","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MS5N5SLYAHKENLAJWYBDKU55ICU3SVZF/"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45873"},{"type":"FIX","url":"https://github.com/systemd/systemd/commit/076b807be472630692c5348c60d0c2b7b28ad437"},{"type":"FIX","url":"https://github.com/systemd/systemd/pull/24853#issuecomment-1326561497"},{"type":"FIX","url":"https://github.com/systemd/systemd/pull/25055#issuecomment-1313733553"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/systemd/systemd","events":[{"introduced":"0"},{"fixed":"076b807be472630692c5348c60d0c2b7b28ad437"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v252-rc2","v252-rc1","v251","v251-rc3","v251-rc2","v251-rc1","v250","v250-rc3","v250-rc2","v250-rc1","v249","v249-rc3","v249-rc2","v249-rc1","v248-2","v248","v248-rc4","v248-rc3","v248-rc2","v248-rc1","v247","v247-rc2","v247-rc1","v246","v246-rc2","v246-rc1","v245","v245-rc2","v245-rc1","v244","v244-rc1","v243","v243-rc2","v243-rc1","v242","v242-rc4","v242-rc3","v242-rc2","v242-rc1","v241","v241-rc2","v241-rc1","v240","v239","v238","v237","v236","v235","v234","v233","v232","v231","v230","v229","v228","v227","v226","v225","v224","v223","v222","v221","v219","v220","v218","v217","v216","v215","v214","v213","v212","v211","v210","v209","v208","v207","v206","v205","v204","v203","v202","v201","v200","v199","v198","v197","v196","v195","v194","v193","v192","v191","v190","v189","v188","v187","v186","v185","v184","v183","v44","v43","v42","v41","v40","v39","v38","v37","v36","v35","v34","v33","v32","v31","v30","v29","v28","v27","v26","v25","v24","v23","v22","v21","v20","v19","v18","v17","v16","v15","v14","v13","v12","v11","v10","v9","v8","v7","v6","v5","v4","v3","v2","v1"],"database_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"59441325756538965850884987738680144644","length":2545},"id":"CVE-2022-45873-c3787ad2","signature_type":"Function","signature_version":"v1","source":"https://github.com/systemd/systemd/commit/076b807be472630692c5348c60d0c2b7b28ad437","target":{"file":"src/shared/elf-util.c","function":"parse_elf_object"}},{"digest":{"line_hashes":["335302405321708938935141396139447868141","8697642566255136586972834532463810006","165316118472527127356869849474597479457","176012190918078567883637533140890888992","76586805774430584948006219143634117807","131809439504104987749757081948358040930","204694553894292713712657883303750991423","25149081735708012731670663668587885756","262753505588102054979328555150575251892","200477040380943634824281176247094748130","207070824076907456731310800294179242202","195325569208689013939052892647214559974","78419687446346223284140477965001469357","25374472437199420228331308369379113330","278861514212515928291602348456102653297","265817781040181873414692713236857902812","286812210026102892882124315784104134172","250825612794042130231410889293438716976","320156420109350792824390978006518495705","142934909001954727484879239751833703574","280488416545389327071463604496060019196","10739368935156455837607182040177420051","19338897423472260498883367470155812439","46770064379441325866531112895884833332","55378196942982274212857241567173145030","290832881425205347568052967243430124077","299973235703449141341453340902261078753","58317034188230598508020871528609599127","277113464624720444567511051036174358258","139438813647028839286574970076643560308"],"threshold":0.9},"id":"CVE-2022-45873-e4c98e5a","signature_type":"Line","signature_version":"v1","source":"https://github.com/systemd/systemd/commit/076b807be472630692c5348c60d0c2b7b28ad437","target":{"file":"src/shared/elf-util.c"},"deprecated":false}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-45873.json","vanir_signatures_modified":"2026-08-03T14:27:40Z"}},{"ranges":[{"type":"GIT","repo":"https://github.com/systemd/systemd-stable","events":[{"introduced":"a420d71793bcbc1539a63be60f83cdc14373ea4a"},{"last_affected":"b622e95f2f59fcb58e23ddafed745eee26a0f52f"},{"introduced":"7dbbb3933d3eff9fd6f44fb38c39b9b452933128"},{"last_affected":"9ca1efbc4624efab1fb30acd79f7b84c53d18206"}],"database_specific":{"extracted_events":[{"introduced":"250"},{"last_affected":"251"},{"introduced":"252-rc1"},{"last_affected":"252-rc1"},{"introduced":"252-rc2"},{"last_affected":"252-rc2"}],"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*","cpe:2.3:a:systemd_project:systemd:252:rc1:*:*:*:*:*:*","cpe:2.3:a:systemd_project:systemd:252:rc2:*:*:*:*:*:*"]}}],"versions":["252-rc1","252-rc2","v252-rc2","v252-rc1","v251","v251-rc3","v251-rc2","v251-rc1","v250"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-45873.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}