Cloudanix VulnDB

CVE-2022-22892

Medium · 5.5

CVSS

5.5

EPSS

0.6%

Published

Jan 21, 2022

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in a media-processing library can make programs using it stop working when they receive certain specially crafted files.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

An assertion failure in the ECMA value type checker causes an immediate process abort when a value of unexpected type is encountered during script execution.

Why it matters to the business

Applications processing untrusted scripts or media files can be forced to crash, interrupting services and requiring restarts; the issue affects widely used media frameworks present in many distributions.

How an attack unfolds

An attacker crafts input containing a value that violates the expected ECMA type constraints, supplies the input to a vulnerable application that invokes the affected Jerryscript code path, and triggers the assertion to terminate the process.

How to fix it

Upgrade gpac to 1.0.1+dfsg1-4+deb11u2 on Debian 11 or to commit 71460d72ec07df766dab0a4d52687529f3efcf0a in the gpac GIT repository; rebuild and redeploy any dependent packages.

How to confirm the fix worked

Confirm the installed gpac binary or library reports a version containing the listed fixes, then re-run the triggering input to verify the assertion no longer fires and the process remains stable.

Typical attack path

  1. Identify an application or service that embeds the vulnerable Jerryscript engine and accepts attacker-controlled input
  2. Prepare a malformed script or media file that produces an unexpected ECMA value type
  3. Deliver the crafted input via file, network stream, or command-line argument
  4. Trigger processing that reaches the failing assertion in ecma-helpers-value.c
  5. Observe denial of service through process crash

How to detect it

Review application and system logs for abrupt process terminations or assertion-failure messages referencing ecma-helpers-value.c around the time of suspected input processing; correlate with file-access or network-receive events.

What your security team should do

  • Apply the listed fixed versions immediately on all systems running gpac or dependent media tools
  • Scan package inventories for any other Jerryscript 3.0.0 embeddings and schedule upgrades
  • Add the fixed package versions to automated vulnerability scanners and CI pipelines
  • Monitor for new public exploits given that exploit code is already available

The record

There is an Assertion 'ecma_is_value_undefined (value) || ecma_is_value_null (value) || ecma_is_value_boolean (value) || ecma_is_value_number (value) || ecma_is_value_string (value) || ecma_is_value_bigint (value) || ecma_is_value_symbol (value) || ecma_is_value_object (value)' failed at jerry-core/ecma/base/ecma-helpers-value.c in Jerryscripts 3.0.0.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:18.04:LTS iotjs 0 No fix
Ubuntu:22.04:LTS iotjs 0 No fix
Ubuntu:Pro:18.04:LTS iotjs 0 No fix
conan jerryscript 3.0.0 No fix

Related vulnerabilities