CVE-2022-37452: Exim Buffer Overflow Vulnerability

CVE-2022-37452 Overview

CVE-2022-37452 is a heap-based buffer overflow vulnerability in Exim, a widely deployed mail transfer agent (MTA), affecting versions before 4.95. The vulnerability exists in the host_name_lookup function within host.c when the sender_host_name is set. An attacker could exploit this vulnerability by sending specially crafted input that triggers the overflow condition in the alias list handling, potentially leading to remote code execution or denial of service.

Critical Impact

This heap-based buffer overflow vulnerability allows unauthenticated remote attackers to potentially execute arbitrary code on vulnerable Exim mail servers, compromising the confidentiality, integrity, and availability of affected systems.

Affected Products

• Exim versions before 4.95
• Debian Linux 10.0

Discovery Timeline

• 2022-08-07 - CVE-2022-37452 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-37452

Vulnerability Analysis

This vulnerability is classified as CWE-787 (Out-of-bounds Write), specifically a heap-based buffer overflow. The flaw resides in the host_name_lookup function in src/src/host.c, which processes host alias lists during SMTP transactions. When sender_host_name is set, the function improperly calculates the required buffer size for storing aliases, leading to a heap buffer overflow condition.

The vulnerability is remotely exploitable without authentication, requiring no user interaction. An attacker can trigger the overflow by connecting to a vulnerable Exim server and manipulating DNS responses or SMTP transaction data that causes the alias list processing to overflow the allocated heap buffer.

Root Cause

The root cause lies in an off-by-one error in the alias count calculation within the host_name_lookup function. The original code failed to properly account for the terminating NULL pointer when allocating memory for the alias list array. The vulnerable code counted aliases but did not include space for the required NULL terminator, causing a heap buffer overflow when the alias list was populated.

Attack Vector

The attack vector is network-based, allowing remote attackers to exploit this vulnerability by:

1. Connecting to a vulnerable Exim mail server
2. Triggering a DNS lookup scenario where sender_host_name becomes set
3. Providing or manipulating alias data that causes the buffer overflow
4. Overwriting adjacent heap memory to achieve code execution or crash the service

 
   if (hosts->h_aliases)
     {
-    int count = 1;
+    int count = 1;  /* need 1 more for terminating NULL */
     uschar **ptr;
 
     for (uschar ** aliases = USS hosts->h_aliases; *aliases; aliases++) count++;

Source: GitHub Commit Change

The patch clarifies that the initial count of 1 is specifically needed for the terminating NULL pointer, addressing the off-by-one allocation error.

Detection Methods for CVE-2022-37452

Indicators of Compromise

• Unexpected crashes or restarts of the Exim mail service
• Abnormal memory consumption by the exim process
• Suspicious SMTP connections with unusual DNS lookups or host name patterns
• Core dumps from Exim showing heap corruption signatures

Detection Strategies

• Monitor Exim server logs for crashes related to heap corruption or segmentation faults
• Deploy network intrusion detection rules to identify malformed SMTP sessions targeting Exim
• Use memory sanitization tools (AddressSanitizer) on test systems to detect exploitation attempts
• Implement version detection scanning to identify unpatched Exim installations below 4.95

Monitoring Recommendations

• Enable detailed logging for SMTP transactions and DNS lookups in Exim configuration
• Set up alerting for Exim process crashes or unexpected restarts
• Monitor system logs for segmentation fault messages from the Exim binary
• Track network traffic patterns for anomalous SMTP connection behavior

How to Mitigate CVE-2022-37452

Immediate Actions Required

• Upgrade Exim to version 4.95 or later immediately
• If immediate upgrade is not possible, consider temporarily disabling or restricting external access to the Exim service
• Review firewall rules to limit SMTP access to trusted networks where feasible
• Enable additional logging to detect potential exploitation attempts

Patch Information

The vulnerability has been addressed in Exim version 4.95. The fix is available through the official GitHub Commit Change. For Debian-based systems, refer to the Debian LTS Security Notice for patched packages. The version comparison between 4.94 and 4.95 containing this fix is available at the GitHub Version Comparison.

Workarounds

• Restrict SMTP access to trusted IP ranges using firewall rules if patching is delayed
• Consider placing vulnerable Exim servers behind a reverse proxy or mail relay running a patched version
• Disable features that trigger sender_host_name lookups if operationally feasible
• Monitor for exploitation attempts while working toward applying the official patch

# Configuration example
# Restrict Exim access via iptables while awaiting patch deployment
iptables -A INPUT -p tcp --dport 25 -s trusted_network/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j DROP

# Verify current Exim version
exim -bV | grep version
# Upgrade to patched version on Debian-based systems
apt-get update && apt-get install exim4