CVE-2022-37451: Exim Use-After-Free Vulnerability

CVE-2022-37451 Overview

CVE-2022-37451 is an invalid free vulnerability affecting Exim mail transfer agent versions before 4.96. The flaw exists in the pam_converse function within auths/call_pam.c, where improper memory management occurs because store_free is not used after store_malloc. This memory corruption issue can be exploited remotely to cause a denial of service condition.

Critical Impact

Remote attackers can exploit this invalid free vulnerability to crash the Exim mail server, disrupting email services for affected organizations.

Affected Products

• Exim versions prior to 4.96
• Fedora 35
• Fedora 36

Discovery Timeline

• 2022-06-25 - Issue discussed on the Exim Mailing List
• 2022-08-06 - CVE-2022-37451 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-37451

Vulnerability Analysis

This vulnerability is classified as CWE-763 (Release of Invalid Pointer or Reference). The root cause lies in a memory management mismatch within the PAM (Pluggable Authentication Modules) authentication handler in Exim. When processing PAM authentication responses, Exim uses its internal memory allocation function string_copy_malloc() to allocate memory for the response data. However, PAM expects to free this memory using standard libc free(). Since Exim's internal allocator and libc's allocator are incompatible, when PAM attempts to free the response memory, it results in an invalid free operation. This can lead to heap corruption and subsequent denial of service through application crash.

Root Cause

The vulnerability stems from the use of Exim's internal memory allocation function string_copy_malloc() for allocating PAM response buffers. PAM's authentication framework assumes that response memory is allocated using standard libc malloc() and subsequently frees it with free(). The mismatch between Exim's custom allocator and PAM's expectation for libc-managed memory creates the invalid free condition when PAM releases the response data after authentication processing.

Attack Vector

An attacker can exploit this vulnerability remotely over the network by triggering PAM authentication attempts. Since Exim is commonly exposed on SMTP ports (25, 465, 587), an attacker could initiate authentication requests that exercise the vulnerable code path. When the PAM subsystem processes and subsequently frees the improperly allocated response buffer, the invalid free corrupts heap memory, potentially causing the Exim process to crash. No authentication is required to trigger this vulnerability, and user interaction is not necessary.

The security patch demonstrates the fix applied to address this vulnerability:

 	arg = US"";
 	pam_arg_ended = TRUE;
 	}
-      reply[i].resp = CS string_copy_malloc(arg); /* PAM frees resp */
+      reply[i].resp = strdup(CCS arg); /* Use libc malloc, PAM frees resp directly*/
       reply[i].resp_retcode = PAM_SUCCESS;
       break;

Source: GitHub Exim Commit Details

Detection Methods for CVE-2022-37451

Indicators of Compromise

• Unexpected Exim process crashes or restarts, particularly during authentication attempts
• Core dump files generated by the Exim daemon indicating heap corruption
• Error messages in mail logs related to PAM authentication failures followed by segmentation faults
• Increased SMTP connection failures reported by monitoring systems

Detection Strategies

• Monitor Exim mail server logs for unexpected daemon termination or restart events
• Implement process monitoring to detect abnormal Exim crashes and automatic restart patterns
• Deploy network monitoring to identify unusual authentication attempt patterns on SMTP ports
• Use heap debugging tools in development environments to identify invalid free operations

Monitoring Recommendations

• Configure alerting for Exim service disruptions and automatic restarts
• Review system logs for segmentation fault entries associated with the Exim process
• Monitor PAM authentication logs for anomalous patterns that may indicate exploitation attempts
• Implement service availability monitoring for critical email infrastructure

How to Mitigate CVE-2022-37451

Immediate Actions Required

• Upgrade Exim to version 4.96 or later immediately
• If immediate upgrade is not possible, consider temporarily disabling PAM authentication
• Review and apply security patches from your Linux distribution's package repository
• Monitor Exim service stability for signs of exploitation attempts

Patch Information

The vulnerability has been addressed in Exim version 4.96. The fix replaces Exim's internal string_copy_malloc() function with the standard libc strdup() function for PAM response allocation. This ensures that memory allocated for PAM responses uses libc's heap, which PAM can safely free. The official patch is available in commit 51be321b. Fedora users should apply updates via the Fedora Package Announcements for their respective versions.

Workarounds

• Disable PAM authentication in Exim configuration if not required for operations
• Implement network-level access controls to limit SMTP authentication attempts to trusted sources
• Deploy rate limiting on authentication endpoints to reduce potential impact
• Consider using alternative authentication mechanisms until patching is complete

# Check current Exim version
exim -bV

# On Fedora systems, update Exim package
sudo dnf update exim

# Verify PAM authentication configuration in Exim
grep -r "driver.*=.*pam" /etc/exim/