CVE-2022-1341
📋 TL;DR
CVE-2022-1341 is a NULL pointer dereference vulnerability in bwm-ng v0.6.2 that allows attackers to cause a denial of service or potentially execute arbitrary code by triggering a null write in the get_cmdln_options() function. This affects systems running the vulnerable version of bwm-ng, a bandwidth monitoring tool commonly used on Linux/Unix systems.
💻 Affected Systems
- bwm-ng
📦 What is this software?
Bwm Ng by Bwm Ng Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if combined with other vulnerabilities, or denial of service causing system crashes.
Likely Case
Application crash leading to denial of service for the bwm-ng monitoring functionality.
If Mitigated
Limited impact with proper privilege separation and minimal user access to the application.
🎯 Exploit Status
Exploitation requires local access or ability to influence command-line arguments passed to bwm-ng.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit 9774f23bf78a6e6d3ae4cfe3d73bad34f2fdcd17
Vendor Advisory: https://github.com/vgropp/bwm-ng/commit/9774f23bf78a6e6d3ae4cfe3d73bad34f2fdcd17
Restart Required: Yes
Instructions:
1. Update bwm-ng to latest version from official repository. 2. Recompile from source if using source distribution. 3. Restart any running bwm-ng processes.
🔧 Temporary Workarounds
Remove vulnerable version
linuxUninstall bwm-ng v0.6.2 and use alternative monitoring tools
sudo apt remove bwm-ng
sudo yum remove bwm-ng
Restrict execution permissions
linuxLimit who can execute bwm-ng to reduce attack surface
sudo chmod 750 /usr/bin/bwm-ng
sudo chown root:root /usr/bin/bwm-ng
🧯 If You Can't Patch
- Disable or remove bwm-ng from affected systems
- Implement strict access controls to limit who can execute bwm-ng
🔍 How to Verify
Check if Vulnerable:
Check bwm-ng version with: bwm-ng --version | grep '0.6.2'Check Version:
bwm-ng --versionVerify Fix Applied:
Verify version is not 0.6.2: bwm-ng --version📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors in system logs related to bwm-ng
- Unexpected termination of bwm-ng process
Network Indicators:
- No network indicators as this is a local vulnerability
SIEM Query:
process.name:"bwm-ng" AND event.action:"segmentation_fault" OR process.terminated