CVE-2023-42118

2023-09-3018:24:37

redhat.com

access.redhat.com

cve-2023-42118

integer underflow

libspf2 library

spf macros

user-supplied data

memory writing

vulnerability

network-adjacent

unprivileged attackers

code execution

service account

7.5 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

28.8%

JSON

An integer underflow flaw was discovered in libspf2 library which exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. This vulnerability allows network-adjacent unprivileged attackers to execute code in the context of the service account.