Skip to content
Fencer Vulns
high 7.0

CVE-2022-39377 json

sysstat Incorrect Buffer Size calculation on 32-bit systems results in RCE via buffer overflow

published 2022-11-08 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-41838

cvss
7.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 71%
public exploits
0
none known

Summary

sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_structures contains a size_t overflow in sa_common.c. The allocate_structures function insufficiently checks bounds before arithmetic multiplication, allowing for an overflow in the size allocated for the buffer representing system activities. This issue may lead to Remote Code Execution (RCE). This issue has been patched in version 12.7.1.

Patch / fix

  • sysstat_project sysstat 12.6.1
  • sysstat Debian 14, Debian 13, Debian 12 12.6.1-1

debian advisories DEBIAN-CVE-2022-39377

  • sysstat Ubuntu 18.04 LTS 11.6.1-1ubuntu0.2
  • sysstat Ubuntu 20.04 LTS 12.2.0-2ubuntu0.2
  • sysstat Ubuntu 22.04 LTS 12.5.2-2ubuntu0.1
  • sysstat Ubuntu Pro 14.04 LTS 10.2.0-1ubuntu0.1~esm1
  • sysstat Ubuntu Pro 16.04 LTS 11.2.0-1ubuntu0.3+esm1

ubuntu advisories UBUNTU-CVE-2022-39377

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • sysstat RHEL 8 11.7.3-9.el8
  • sysstat RHEL 9 12.5.4-5.el9

red hat advisories RHSA-2023:2800RHSA-2023:2234

  • sysstat SLE Module for Server Applications 15 SP6, SLE Module for Basesystem 15 SP6, SLE Micro 5.5 +6 more 12.0.2-150000.3.37.1
  • sysstat SLES LTSS Extended Security 12 SP5 12.0.2-20.23.1

suse advisories SUSE-SU-2025:0019-1SUSE-SU-2025:0012-1

  • sysstat openSUSE Tumbleweed 12.6.1-2.1

opensuse advisories openSUSE-SU-2024:12658-1

  • sysstat AlmaLinux 8 11.7.3-9.el8
  • sysstat AlmaLinux 9 12.5.4-5.el9

almalinux advisories ALSA-2023:2800ALSA-2023:2234

  • sysstat Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 12.6.2-r0

alpine advisories ALPINE-CVE-2022-39377

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • sysstat CBL-Mariner 2.0 12.7.1-1

azure linux advisories AZL-11450

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-39377 updated cvss 7.8

sysstat: arithmetic overflow in allocate_structures() on 32 bit systems

  • Red Hat Enterprise Linux 7 sysstat
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 8) sysstat 11.7.3-9.el8
    fixed: vendor fix RHSA-2023:2800
  • Red Hat Enterprise Linux AppStream (v. 9) sysstat 12.5.4-5.el9
    fixed: vendor fix RHSA-2023:2234

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
18 mo ago

Exploit prediction

1.36% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/sysstat/sysstat/security/advisories/GHSA-q8r6-g56f-9w7x referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • sysstat sysstat

Classification

Weakness
  • CWE-131 Incorrect Calculation of Buffer Size
  • CWE-120 Buffer Copy without Checking Size of Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.