---
id: CVE-2022-23218
title: >-
  The deprecated compatibility function svcunix_create in the sunrpc module of
  the GNU C Library (aka glibc) through 2.34 copies its path argument on the
  stack without validating its length, which may result in a buffer overflow,
  potential…
summary: >-
  The deprecated compatibility function svcunix_create in the sunrpc module of
  the GNU C Library (aka glibc) through 2.34 copies its path argument on the
  stack without validating its length, which may result in a buffer overflow,
  potential…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-120
  - CWE-120
vendor: gnu
product: glibc
affected:
  - glibc < 2.31
  - communications_cloud_native_core_unified_data_repository = 22.2.0
  - enterprise_operations_monitor = 4.3
  - enterprise_operations_monitor = 4.4
  - enterprise_operations_monitor = 5.0
  - debian_linux = 10.0
patched:
  - glibc 2.31
published: '2022-01-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T16:17:26.663'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-23218'
references:
  - url: 'https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html'
    label: cve@mitre.org
  - url: 'https://security.gentoo.org/glsa/202208-24'
    label: cve@mitre.org
  - url: 'https://sourceware.org/bugzilla/show_bug.cgi?id=28768'
    label: cve@mitre.org
  - url: 'https://www.oracle.com/security-alerts/cpujul2022.html'
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/202208-24'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://sourceware.org/bugzilla/show_bug.cgi?id=28768'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpujul2022.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-099606.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-831302.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.0482
epssPercentile: 0.91786
ingestedAt: '2026-10-14T16:40:32.044Z'
---

## Overview

The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

## Affected

- `glibc < 2.31`
- `communications_cloud_native_core_unified_data_repository = 22.2.0`
- `enterprise_operations_monitor = 4.3`
- `enterprise_operations_monitor = 4.4`
- `enterprise_operations_monitor = 5.0`
- `debian_linux = 10.0`

## Remediation

Upgrade past the affected range:

- `glibc 2.31`