CVE-2022-37451: Exim Use-After-Free Vulnerability

CVE-2022-37451 Overview

CVE-2022-37451 is an invalid free vulnerability affecting Exim mail transfer agent versions before 4.96. The flaw exists in the pam_converse function within auths/call_pam.c, where improper memory management occurs because store_free is not used after store_malloc. This memory corruption issue can be exploited remotely to cause a denial of service condition.

Critical Impact
Remote attackers can exploit this invalid free vulnerability to crash the Exim mail server, disrupting email services for affected organizations.

Affected Products

Exim versions prior to 4.96
Fedora 35
Fedora 36

Discovery Timeline

2022-06-25 - Issue discussed on the Exim Mailing List
2022-08-06 - CVE-2022-37451 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-37451

Vulnerability Analysis

This vulnerability is classified as CWE-763 (Release of Invalid Pointer or Reference). The root cause lies in a memory management mismatch within the PAM (Pluggable Authentication Modules) authentication handler in Exim. When processing PAM authentication responses, Exim uses its internal memory allocation function string_copy_malloc() to allocate memory for the response data. However, PAM expects to free this memory using standard libc free(). Since Exim's internal allocator and libc's allocator are incompatible, when PAM attempts to free the response memory, it results in an invalid free operation. This can lead to heap corruption and subsequent denial of service through application crash.

Root Cause

The vulnerability stems from the use of Exim's internal memory allocation function string_copy_malloc() for allocating PAM response buffers. PAM's authentication framework assumes that response memory is allocated using standard libc malloc() and subsequently frees it with free(). The mismatch between Exim's custom allocator and PAM's expectation for libc-managed memory creates the invalid free condition when PAM releases the response data after authentication processing.

Attack Vector

An attacker can exploit this vulnerability remotely over the network by triggering PAM authentication attempts. Since Exim is commonly exposed on SMTP ports (25, 465, 587), an attacker could initiate authentication requests that exercise the vulnerable code path. When the PAM subsystem processes and subsequently frees the improperly allocated response buffer, the invalid free corrupts heap memory, potentially causing the Exim process to crash. No authentication is required to trigger this vulnerability, and user interaction is not necessary.

The security patch demonstrates the fix applied to address this vulnerability:

 	arg = US"";
 	pam_arg_ended = TRUE;
 	}
-      reply[i].resp = CS string_copy_malloc(arg); /* PAM frees resp */
+      reply[i].resp = strdup(CCS arg); /* Use libc malloc, PAM frees resp directly*/
       reply[i].resp_retcode = PAM_SUCCESS;
       break;

Source: GitHub Exim Commit Details

Detection Methods for CVE-2022-37451

Indicators of Compromise

Unexpected Exim process crashes or restarts, particularly during authentication attempts
Core dump files generated by the Exim daemon indicating heap corruption
Error messages in mail logs related to PAM authentication failures followed by segmentation faults
Increased SMTP connection failures reported by monitoring systems

Detection Strategies

Monitor Exim mail server logs for unexpected daemon termination or restart events
Implement process monitoring to detect abnormal Exim crashes and automatic restart patterns
Deploy network monitoring to identify unusual authentication attempt patterns on SMTP ports
Use heap debugging tools in development environments to identify invalid free operations

Monitoring Recommendations

Configure alerting for Exim service disruptions and automatic restarts
Review system logs for segmentation fault entries associated with the Exim process
Monitor PAM authentication logs for anomalous patterns that may indicate exploitation attempts
Implement service availability monitoring for critical email infrastructure

How to Mitigate CVE-2022-37451

Immediate Actions Required

Upgrade Exim to version 4.96 or later immediately
If immediate upgrade is not possible, consider temporarily disabling PAM authentication
Review and apply security patches from your Linux distribution's package repository
Monitor Exim service stability for signs of exploitation attempts

Patch Information

The vulnerability has been addressed in Exim version 4.96. The fix replaces Exim's internal string_copy_malloc() function with the standard libc strdup() function for PAM response allocation. This ensures that memory allocated for PAM responses uses libc's heap, which PAM can safely free. The official patch is available in commit 51be321b. Fedora users should apply updates via the Fedora Package Announcements for their respective versions.

Workarounds

Disable PAM authentication in Exim configuration if not required for operations
Implement network-level access controls to limit SMTP authentication attempts to trusted sources
Deploy rate limiting on authentication endpoints to reduce potential impact
Consider using alternative authentication mechanisms until patching is complete

bash

# Check current Exim version
exim -bV

# On Fedora systems, update Exim package
sudo dnf update exim

# Verify PAM authentication configuration in Exim
grep -r "driver.*=.*pam" /etc/exim/