CVE-2025-32022

Name	CVE-2025-32022
Description	Finit provides fast init for Linux systems. Finit's urandom plugin has a heap buffer overwrite vulnerability at boot which leads to it overwriting other parts of the heap, possibly causing random instabilities and undefined behavior. The urandom plugin is enabled by default, so this bug affects everyone using Finit 4.2 or later that do not explicitly disable the plugin at build time. This bug is fixed in Finit 4.12. Those who cannot upgrade or backport the fix to urandom.c are strongly recommended to disable the plugin in the call to the `configure` script.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1104932

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
finit (PTS)	bookworm	4.2-1	vulnerable
	sid, trixie	4.11-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
finit	source	(unstable)	(unfixed)			1104932

Notes

[bookworm] - finit <no-dsa> (Minor issue)
https://github.com/troglobit/finit/security/advisories/GHSA-fv6v-vw8h-9x79
Fixed by: https://github.com/troglobit/finit/commit/3feff37ba51fa0a6a0a06f59682a0918aa5b04de (4.12)