Explotation Buffer Overflow - CVE-2022-4378.yml

title: Explotation Buffer Overflow CVE-2022-4378
status: experimental
author: A.W. Networksecure Segurança da Informação LTDA.
date: 2023/12/04
description: Explotation of vulnerability bufferoverflow through CVE 2022-4378 with public exploit
references:
  - https://seclists.org/oss-sec/2022/q4/178
tags:
  - attack.DS0017
  - attack.T1611
logsource:
  category: 
   - kernel
   - operation system
   - edr
  product: linux
detection:
  selection:
    command: 
      - gcc -o
      - unshare -n
      - './poc'
      - './exploit'
    nome:
      - obs: "ainda falta ser verificado junto ao fabricante"
  condition: 
    - OR
fields:
  - command
  - nome
level: medium