medium 5.5

CVE-2022-45873 json

systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace.

published 2022-11-23 3 y ago modified 2026-10-14 25 d ago also EUVD-2022-48725

cvss: 5.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits: 0; none known

systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology is to crash a binary calling the same function recursively, and put it in a deeply nested directory to make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16 is set for the systemd/units/systemd-coredump.socket file.

Patch / fix

fixed in 3 distros 5 links 3

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5

debian red hat almalinux rocky linux azure linux

systemd Debian 14, Debian 13, Debian 12 252-1

debian advisories DEBIAN-CVE-2022-45873

systemd RHEL 9 250-12.el9_1.3
systemd-pam RHEL 9 250-12.el9_1.3
systemd-libs RHEL 9 250-12.el9_1.3
systemd-oomd RHEL 9 250-12.el9_1.3
systemd-udev RHEL 9 250-12.el9_1.3
systemd-resolved RHEL 9 250-12.el9_1.3
systemd-container RHEL 9 250-12.el9_1.3
systemd-rpm-macros RHEL 9 250-12.el9_1.3

red hat advisories RHSA-2023:0954

systemd AlmaLinux 9 250-12.el9_1.3
systemd-pam AlmaLinux 9 250-12.el9_1.3
systemd-libs AlmaLinux 9 250-12.el9_1.3
systemd-oomd AlmaLinux 9 250-12.el9_1.3
systemd-udev AlmaLinux 9 250-12.el9_1.3
systemd-resolved AlmaLinux 9 250-12.el9_1.3
systemd-container AlmaLinux 9 250-12.el9_1.3
systemd-rpm-macros AlmaLinux 9 250-12.el9_1.3

almalinux advisories ALSA-2023:0954

systemd Rocky Linux 9 250-12.el9_1.3

rocky linux advisories RLSA-2023:0954

systemd CBL-Mariner 2.0 250.3-12
systemd-bootstrap Azure Linux 3.0 250.3-17

azure linux advisories AZL-11523 AZL-41470

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

github.com/systemd/systemd@076b807 commit
github.com/systemd/systemd#25055 pull request
github.com/systemd/systemd#24853 pull request

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-45873 updated 2026-11-07 cvss 5.5

systemd: deadlock in systemd-coredump via a crash with a long backtrace

Red Hat Enterprise Linux 7 systemd, libgudev1, systemd-libs, systemd-sysv, NetworkManager, systemd-python, +16 more
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux AppStream (v. 9) systemd-journal-remote 250-12.el9_1.3 Red Hat Enterprise Linux BaseOS (v. 9) systemd 250-12.el9_1.3, systemd-pam 250-12.el9_1.3, systemd-libs 250-12.el9_1.3, systemd-oomd 250-12.el9_1.3, systemd-udev 250-12.el9_1.3, systemd-resolved 250-12.el9_1.3, +2 more
fixed: vendor fix RHSA-2023:0954
Red Hat Enterprise Linux 8 systemd, systemd-pam, systemd-libs, systemd-udev, systemd-tests, NetworkManager, +16 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-348-10 updated 2025-08-12 cvss 5.5

Siemens SIMATIC S7-1500

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 18 mo ago (2025-04-25)

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption

References

github.com /systemd/systemd/commit/076b807be472630692c5348c60d0c2b7b28ad437
patch, third-party-advisory
github.com /systemd/systemd/pull/25055#issuecomment-1313733553
issue-tracking, patch, third-party-advisory
github.com /systemd/systemd/pull/24853#issuecomment-1326561497
issue-tracking, patch, third-party-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/MS5N5SLYAHKENLAJWYBDKU55ICU3SVZF/
vendor-advisory
cert-portal.siemens.com /productcert/html/ssa-398330.html

Sources

CVE List CVE-2022-45873
NVD CVE-2022-45873

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary