CVE-2022-49043
📋 TL;DR
CVE-2022-49043 is a use-after-free vulnerability in libxml2's xmlXIncludeAddNode function that allows attackers to execute arbitrary code or cause denial of service. This affects any application that uses libxml2 to parse XML documents with XInclude processing enabled. The vulnerability is particularly dangerous for applications that process untrusted XML input.
💻 Affected Systems
- libxml2
- PHP (when compiled with libxml2)
- GNOME applications
- various Linux packages using libxml2
📦 What is this software?
Libxml2 by Xmlsoft
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crash causing denial of service, potentially leading to data corruption or service disruption.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially just application instability.
🎯 Exploit Status
Exploitation requires crafting malicious XML with XInclude directives. No public exploits known as of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: libxml2 2.11.0 or later
Vendor Advisory: https://gitlab.gnome.org/GNOME/libxml2/-/commit/5a19e21605398cef6a8b1452477a8705cb41562b
Restart Required: No
Instructions:
1. Update libxml2 to version 2.11.0 or later. 2. For Linux distributions: Use package manager (apt update && apt upgrade libxml2, yum update libxml2, etc.). 3. Recompile applications if statically linked. 4. Restart affected services.
🔧 Temporary Workarounds
Disable XInclude Processing
allConfigure applications to disable XInclude processing when parsing untrusted XML.
Set XML_PARSE_NOXINCNODE flag in libxml2 parser options
🧯 If You Can't Patch
- Disable XInclude processing in all XML parsers
- Implement strict XML input validation and sanitization
🔍 How to Verify
Check if Vulnerable:
Check libxml2 version: xml2-config --version or dpkg -l libxml2 | grep ^iiCheck Version:
xml2-config --version || dpkg -l libxml2 | grep ^ii || rpm -q libxml2Verify Fix Applied:
Verify version is 2.11.0 or higher: xml2-config --version📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- Memory corruption errors in logs
- Unexpected process termination
Network Indicators:
- Unusual XML payloads with XInclude directives
- Repeated XML parsing requests causing crashes
SIEM Query:
process.name: ("php", "application") AND event.action: ("segmentation fault", "SIGSEGV")