CVE-2022-22752

What it actually does

Memory corruption flaws in the affected component allow an attacker to overwrite memory contents, potentially leading to arbitrary code execution when specially crafted input is processed.

Why it matters to the business

Successful exploitation can result in full compromise of the running process or container environment, enabling data theft, service disruption, or further lateral movement; low but non-zero exploit probability combined with widespread use of the packages increases the need for prompt patching to avoid operational risk.

How an attack unfolds

An attacker crafts malicious input that triggers one of the memory safety bugs, causing memory corruption during processing; with sufficient effort this corruption can be turned into code execution, allowing the attacker to run arbitrary commands within the context of the vulnerable process.

How to fix it

Upgrade to the fixed versions provided: docker.io on Debian 12/13 to 20.10.19+dfsg1-1 and moby/moby to commit de7af816e76a7fd3fbf06bffa6832959289fba32; restart affected services after upgrade and verify no custom builds retain the vulnerable code.

How to confirm the fix worked

Confirm package versions match or exceed the listed fixed releases using the system's package manager; review build logs or container images to ensure the corrected commit is present; re-test with known triggering inputs if available in a lab environment.

Typical attack path

1. Identify a reachable instance of the vulnerable package
2. Deliver crafted input that triggers a memory safety bug
3. Leverage resulting memory corruption to achieve code execution
4. Execute post-exploitation actions such as installing persistence or exfiltrating data

How to detect it

Review process crash logs and memory error reports for signs of corruption; inspect network traffic or input streams that precede unexpected process behavior; correlate with package version data to identify unpatched instances.

What your security team should do

• Apply the specified package upgrades immediately given the high CVSS and memory corruption nature
• Scan all container images and hosts for the vulnerable versions and prioritize remediation
• Monitor EPSS trend and any new exploit publications for changes in risk
• Implement runtime protections such as address space layout randomization and container isolation where upgrades are delayed