CVE-2022-28044
📋 TL;DR
CVE-2022-28044 is a heap memory corruption vulnerability in lrzip's initialise_control function that allows attackers to execute arbitrary code or cause denial of service. This affects systems running lrzip v0.640 for file compression/decompression operations. Users processing untrusted archives with lrzip are particularly vulnerable.
💻 Affected Systems
- lrzip
📦 What is this software?
Irzip by Irzip Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the lrzip process, potentially leading to full system compromise.
Likely Case
Application crash (denial of service) when processing maliciously crafted archives.
If Mitigated
Limited to denial of service if proper sandboxing/privilege separation is implemented.
🎯 Exploit Status
Proof of concept available in GitHub issues. Exploitation requires user to process a malicious archive.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit 5faf80cd53ecfd16b636d653483144cd12004f46
Vendor Advisory: https://www.debian.org/security/2022/dsa-5145
Restart Required: No
Instructions:
1. Update lrzip package using system package manager. 2. For Debian/Ubuntu: sudo apt update && sudo apt upgrade lrzip. 3. For source install: git pull from repository and rebuild.
🔧 Temporary Workarounds
Disable lrzip usage
linuxRemove or disable lrzip binary to prevent exploitation
sudo apt remove lrzip
sudo rm /usr/bin/lrzip
Restrict file processing
allImplement strict file validation before lrzip processes archives
🧯 If You Can't Patch
- Implement strict access controls to limit who can run lrzip
- Use containerization/sandboxing to isolate lrzip processes
🔍 How to Verify
Check if Vulnerable:
Check lrzip version: lrzip --version | grep 'lrzip version'Check Version:
lrzip --versionVerify Fix Applied:
Verify version is newer than 0.640 or check for commit 5faf80cd53ecfd16b636d653483144cd12004f46 in source📡 Detection & Monitoring
Log Indicators:
- Segmentation fault or crash logs from lrzip process
- Unexpected memory access errors
Network Indicators:
- Unusual outbound connections after lrzip execution
SIEM Query:
process_name='lrzip' AND (event_id='SIGSEGV' OR exit_code='139')🔗 References
- https://github.com/ckolivas/lrzip/commit/5faf80cd53ecfd16b636d653483144cd12004f46
- https://github.com/ckolivas/lrzip/issues/216
- https://lists.debian.org/debian-lts-announce/2022/05/msg00016.html
- https://www.debian.org/security/2022/dsa-5145
- https://github.com/ckolivas/lrzip/commit/5faf80cd53ecfd16b636d653483144cd12004f46
- https://github.com/ckolivas/lrzip/issues/216
- https://lists.debian.org/debian-lts-announce/2022/05/msg00016.html
- https://www.debian.org/security/2022/dsa-5145
