CVE-2025-32022

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-32022
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32022.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-32022
Aliases
  • GHSA-fv6v-vw8h-9x79
Related
Published
2025-05-06T17:16:12Z
Modified
2025-05-20T03:16:24.656719Z
Summary
[none]
Details

Finit provides fast init for Linux systems. Finit's urandom plugin has a heap buffer overwrite vulnerability at boot which leads to it overwriting other parts of the heap, possibly causing random instabilities and undefined behavior. The urandom plugin is enabled by default, so this bug affects everyone using Finit 4.2 or later that do not explicitly disable the plugin at build time. This bug is fixed in Finit 4.12. Those who cannot upgrade or backport the fix to urandom.c are strongly recommended to disable the plugin in the call to the configure script.

References

Affected packages

Debian:12 / finit

Package

Name
finit
Purl
pkg:deb/debian/finit?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.2-1
4.7-1
4.7-2
4.7-3
4.11-1
4.12-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / finit

Package

Name
finit
Purl
pkg:deb/debian/finit?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.2-1
4.7-1
4.7-2
4.7-3
4.11-1
4.12-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/troglobit/finit

Affected ranges

Type
GIT
Repo
https://github.com/troglobit/finit
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3feff37ba51fa0a6a0a06f59682a0918aa5b04de

Affected versions

0.*

0.1
0.2
0.3
0.4
0.5
0.6-pre

1.*

1.0
1.1
1.10
1.11
1.12
1.2
1.3
1.4
1.5
1.6
1.7
1.8
1.9

2.*

2.0
2.1
2.2
2.3
2.4

3.*

3.0
3.0-rc1
3.0-rc2
3.1
3.1-rc1
3.1-rc2
3.2-rc1
3.2-rc2
3.2-rc3

4.*

4.0
4.0-rc1
4.0-rc2
4.0-rc3
4.0-rc4
4.1
4.1-rc1
4.1-rc2
4.10
4.10-rc1
4.10-rc2
4.11
4.11-rc1
4.11-rc2
4.2
4.3
4.3-rc1
4.3-rc2
4.4
4.4-rc1
4.4-rc2
4.5
4.5-rc1
4.5-rc2
4.5-rc3
4.5-rc4
4.5-rc5
4.6
4.7
4.8
4.9
4.9-rc1