CVE-2022-3821

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-11-08 · updated 2026-10-14
Weakness: CWE-193

Description

An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.

Affected products

Fedoraproject Fedora: 35
Red Hat Enterprise Linux: 8.0, 9.0
systemd: through 251

References

https://bugzilla.redhat.com/show_bug.cgi?id=2139327
https://github.com/systemd/systemd/commit/9102c625a673a3246d7e73d8737f3494446bad4e
https://github.com/systemd/systemd/issues/23928
https://github.com/systemd/systemd/pull/23933
https://lists.debian.org/debian-lts-announce/2023/06/msg00036.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RVBQC2VLSDVQAPJTEMTREXDL4HYLXG2P/
https://security.gentoo.org/glsa/202305-15
https://bugzilla.redhat.com/show_bug.cgi?id=2139327
https://github.com/systemd/systemd/commit/9102c625a673a3246d7e73d8737f3494446bad4e
https://github.com/systemd/systemd/issues/23928
https://github.com/systemd/systemd/pull/23933
https://lists.debian.org/debian-lts-announce/2023/06/msg00036.html

Get alerted when CVE-2022-3821 or the next vulnerability affects your stack