CVE-2022-1117

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

A vulnerability was found in fapolicyd. The vulnerability occurs due to an assumption on how glibc names the runtime linker, a build time regular expression may not correctly detect the runtime linker. The consequence is that the pattern detection for applications launched by the run time linker may fail to detect the pattern and allow execution.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-552

Affected software

Vendor	Product	Versions
n/a	fapolicyd	Fixed in v1.1.2

References

https://access.redhat.com/security/cve/CVE-2022-1117Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2066904Permissions Required, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2068171Issue Tracking, Third Party Advisory
https://github.com/linux-application-whitelisting/fapolicyd/commit/38a942613f93824c53164730b2b7a2f75b8cd263Patch, Third Party Advisory
https://access.redhat.com/security/cve/CVE-2022-1117Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2066904Permissions Required, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2068171Issue Tracking, Third Party Advisory
https://github.com/linux-application-whitelisting/fapolicyd/commit/38a942613f93824c53164730b2b7a2f75b8cd263Patch, Third Party Advisory

Timeline

Published: Aug 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-11187.8Connected Components Workbench (v13.00.00 and prior), ISaGRAF Workbench (v6.0 though v6.6.9), and Safety Instrumented System Workstation (v1 CVE-2022-11197.5The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloade CVE-2022-11206.5Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 CVE-2022-11215.3A lack of appropriate timeouts in GitLab Pages included in GitLab CE/EE all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior t CVE-2022-11225.5A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. Wh CVE-2022-11237.2The Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) WordPress plugin before 3.12.5 does not properly sanitize some parameters be CVE-2022-11244.3An improper authorization issue has been discovered in GitLab CE/EE affecting all versions prior to 14.8.6, all versions from 14.9.0 prior t CVE-2022-11258.8Use after free in Portals in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user CVE-2022-11278.8Use after free in QR Code Generator in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in spec CVE-2022-11286.5Inappropriate implementation in Web Share API in Google Chrome on Windows prior to 100.0.4896.60 allowed an attacker on the local network se CVE-2022-11296.5Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to spoof the c CVE-2022-11308.1Insufficient validation of trust input in WebOTP in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to send arbitr