CVE-2022-37452: Exim Buffer Overflow Vulnerability

CVE-2022-37452 Overview

CVE-2022-37452 is a heap-based buffer overflow vulnerability in Exim, a widely deployed mail transfer agent (MTA), affecting versions before 4.95. The vulnerability exists in the host_name_lookup function within host.c when the sender_host_name is set. An attacker could exploit this vulnerability by sending specially crafted input that triggers the overflow condition in the alias list handling, potentially leading to remote code execution or denial of service.

Critical Impact
This heap-based buffer overflow vulnerability allows unauthenticated remote attackers to potentially execute arbitrary code on vulnerable Exim mail servers, compromising the confidentiality, integrity, and availability of affected systems.

Affected Products

Exim versions before 4.95
Debian Linux 10.0

Discovery Timeline

2022-08-07 - CVE-2022-37452 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-37452

Vulnerability Analysis

This vulnerability is classified as CWE-787 (Out-of-bounds Write), specifically a heap-based buffer overflow. The flaw resides in the host_name_lookup function in src/src/host.c, which processes host alias lists during SMTP transactions. When sender_host_name is set, the function improperly calculates the required buffer size for storing aliases, leading to a heap buffer overflow condition.

The vulnerability is remotely exploitable without authentication, requiring no user interaction. An attacker can trigger the overflow by connecting to a vulnerable Exim server and manipulating DNS responses or SMTP transaction data that causes the alias list processing to overflow the allocated heap buffer.

Root Cause

The root cause lies in an off-by-one error in the alias count calculation within the host_name_lookup function. The original code failed to properly account for the terminating NULL pointer when allocating memory for the alias list array. The vulnerable code counted aliases but did not include space for the required NULL terminator, causing a heap buffer overflow when the alias list was populated.

Attack Vector

The attack vector is network-based, allowing remote attackers to exploit this vulnerability by:

Connecting to a vulnerable Exim mail server
Triggering a DNS lookup scenario where sender_host_name becomes set
Providing or manipulating alias data that causes the buffer overflow
Overwriting adjacent heap memory to achieve code execution or crash the service

 
   if (hosts->h_aliases)
     {
-    int count = 1;
+    int count = 1;  /* need 1 more for terminating NULL */
     uschar **ptr;
 
     for (uschar ** aliases = USS hosts->h_aliases; *aliases; aliases++) count++;

Source: GitHub Commit Change

The patch clarifies that the initial count of 1 is specifically needed for the terminating NULL pointer, addressing the off-by-one allocation error.

Detection Methods for CVE-2022-37452

Indicators of Compromise

Unexpected crashes or restarts of the Exim mail service
Abnormal memory consumption by the exim process
Suspicious SMTP connections with unusual DNS lookups or host name patterns
Core dumps from Exim showing heap corruption signatures

Detection Strategies

Monitor Exim server logs for crashes related to heap corruption or segmentation faults
Deploy network intrusion detection rules to identify malformed SMTP sessions targeting Exim
Use memory sanitization tools (AddressSanitizer) on test systems to detect exploitation attempts
Implement version detection scanning to identify unpatched Exim installations below 4.95

Monitoring Recommendations

Enable detailed logging for SMTP transactions and DNS lookups in Exim configuration
Set up alerting for Exim process crashes or unexpected restarts
Monitor system logs for segmentation fault messages from the Exim binary
Track network traffic patterns for anomalous SMTP connection behavior

How to Mitigate CVE-2022-37452

Immediate Actions Required

Upgrade Exim to version 4.95 or later immediately
If immediate upgrade is not possible, consider temporarily disabling or restricting external access to the Exim service
Review firewall rules to limit SMTP access to trusted networks where feasible
Enable additional logging to detect potential exploitation attempts

Patch Information

The vulnerability has been addressed in Exim version 4.95. The fix is available through the official GitHub Commit Change. For Debian-based systems, refer to the Debian LTS Security Notice for patched packages. The version comparison between 4.94 and 4.95 containing this fix is available at the GitHub Version Comparison.

Workarounds

Restrict SMTP access to trusted IP ranges using firewall rules if patching is delayed
Consider placing vulnerable Exim servers behind a reverse proxy or mail relay running a patched version
Disable features that trigger sender_host_name lookups if operationally feasible
Monitor for exploitation attempts while working toward applying the official patch

bash

# Configuration example
# Restrict Exim access via iptables while awaiting patch deployment
iptables -A INPUT -p tcp --dport 25 -s trusted_network/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j DROP

# Verify current Exim version
exim -bV | grep version
# Upgrade to patched version on Debian-based systems
apt-get update && apt-get install exim4