CVE-2022-1664
📋 TL;DR
This vulnerability in dpkg allows directory traversal when extracting specially crafted source packages, enabling attackers to write arbitrary files outside the intended extraction directory. It affects Debian-based systems using vulnerable dpkg versions to process untrusted source packages. The high CVSS score reflects the potential for remote code execution.
💻 Affected Systems
- dpkg
📦 What is this software?
Dpkg by Debian
Dpkg by Debian
Dpkg by Debian
Dpkg by Debian
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, privilege escalation, or data exfiltration.
Likely Case
Local privilege escalation or arbitrary file overwrite when processing malicious source packages.
If Mitigated
Limited impact if only trusted source packages are processed or proper sandboxing is in place.
🎯 Exploit Status
Exploitation requires the ability to provide malicious source packages to dpkg for extraction.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: dpkg 1.21.8, 1.20.10, 1.19.8, or 1.18.26
Vendor Advisory: https://lists.debian.org/debian-lts-announce/2022/05/msg00033.html
Restart Required: No
Instructions:
1. Update dpkg using your package manager: sudo apt update && sudo apt upgrade dpkg. 2. Verify the installed version meets the patched requirements.
🔧 Temporary Workarounds
Avoid processing untrusted source packages
linuxOnly extract source packages from trusted sources and verify checksums.
Use sandboxed extraction
linuxExtract source packages in isolated containers or chroot environments.
🧯 If You Can't Patch
- Restrict dpkg source extraction to trusted users only.
- Monitor for suspicious file writes outside expected extraction directories.
🔍 How to Verify
Check if Vulnerable:
Check dpkg version with: dpkg --version | head -1Check Version:
dpkg --version | head -1Verify Fix Applied:
Confirm version is 1.21.8, 1.20.10, 1.19.8, or 1.18.26 or later.📡 Detection & Monitoring
Log Indicators:
- Failed file writes outside extraction directories
- Unusual dpkg source extraction processes
Network Indicators:
- Downloads of source packages from untrusted sources
SIEM Query:
Process execution where command contains 'dpkg-source' and arguments include '--extract' or similar.🔗 References
- https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=1f23dddc17f69c9598477098c7fb9936e15fa495
- https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=58814cacee39c4ce9e2cd0e3a3b9b57ad437eff5
- https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=7a6c03cb34d4a09f35df2f10779cbf1b70a5200b
- https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=faa4c92debe45412bfcf8a44f26e827800bb24be
- https://lists.debian.org/debian-lts-announce/2022/05/msg00033.html
- https://lists.debian.org/debian-security-announce/2022/msg00115.html
- https://security.netapp.com/advisory/ntap-20221007-0002/
- https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=1f23dddc17f69c9598477098c7fb9936e15fa495
- https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=58814cacee39c4ce9e2cd0e3a3b9b57ad437eff5
- https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=7a6c03cb34d4a09f35df2f10779cbf1b70a5200b
- https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=faa4c92debe45412bfcf8a44f26e827800bb24be
- https://lists.debian.org/debian-lts-announce/2022/05/msg00033.html
- https://lists.debian.org/debian-security-announce/2022/msg00115.html
- https://security.netapp.com/advisory/ntap-20221007-0002/
