UBUNTU-CVE-2025-32022

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2025-32022
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-32022.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2025-32022
Related
Published
2025-05-06T17:16:00Z
Modified
2025-05-07T16:36:20Z
Summary
[none]
Details

Finit provides fast init for Linux systems. Finit's urandom plugin has a heap buffer overwrite vulnerability at boot which leads to it overwriting other parts of the heap, possibly causing random instabilities and undefined behavior. The urandom plugin is enabled by default, so this bug affects everyone using Finit 4.2 or later that do not explicitly disable the plugin at build time. This bug is fixed in Finit 4.12. Those who cannot upgrade or backport the fix to urandom.c are strongly recommended to disable the plugin in the call to the configure script.

References

Affected packages

Ubuntu:22.04:LTS / finit

Package

Name
finit
Purl
pkg:deb/ubuntu/finit@4.2-1?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.1-1
4.2-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.10 / finit

Package

Name
finit
Purl
pkg:deb/ubuntu/finit@4.7-2?arch=source&distro=oracular

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.7-1build2
4.7-2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / finit

Package

Name
finit
Purl
pkg:deb/ubuntu/finit@4.7-1build2?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.2-1
4.7-1
4.7-1build1
4.7-1build2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:25.04 / finit

Package

Name
finit
Purl
pkg:deb/ubuntu/finit@4.7-3?arch=source&distro=plucky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.7-2
4.7-3

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}