CVE-2022-45142

Published: Mar 6, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.

Affected (2)

Products: Heimdal Project: Heimdal

Heimdal Project

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Heimdal Project Heimdal	Version 7.7.1
Heimdal Project Heimdal	Version 7.8.0

Related CWEs

Improper Validation of Integrity Check Value

The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

References (4)

https://security.gentoo.org/glsa/202310-06

Source: secalert@redhat.com

https://www.openwall.com/lists/oss-security/2023/02/08/1

Source: secalert@redhat.com

Mailing List

https://security.gentoo.org/glsa/202310-06

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.openwall.com/lists/oss-security/2023/02/08/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

Timeline

No history available yet.