CVE-2022-23219
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without…
Published Jan 14, 2022 · updated Oct 14, 2026 · gnu glibc
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Jan 14, 2022 · NIST NVD
Detected
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
Oct 14, 2026 · NIST NVD
Updated
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
Affected
- cpe debian/debian linux10.0
- cpe gnu/glibcversion unspecified
- cpe oracle/communications cloud native core binding support function22.1.3
- cpe oracle/communications cloud native core network function cloud native environment22.1.0
- cpe oracle/communications cloud native core network repository function22.1.2
- cpe oracle/communications cloud native core network repository function22.2.0
- cpe oracle/communications cloud native core security edge protection proxy22.1.1
- cpe oracle/communications cloud native core unified data repository22.2.0
- cpe oracle/enterprise operations monitor4.3
Sources
- CVE.orgVulnerability recordCVE-2022-23219
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2022-23219
30-day exploitation probability 4.7%
first.org - NIST NVDVulnerability recordCVE-2022-23219
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if
nvd.nist.gov