CVE-2022-2652CWE-134

Use of Externally-Controlled Format String in umlaeute/v4l2loopback

High · published August 4, 2022

CVSS v3.0
7.3
EPSS
0%
Percentile
25.6
In the wild
Unconfirmed
What it is

Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).

The record
Technical detail
CVSS v3.0
7.3 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00334 · 25.6th percentile
Weakness
CWE-134 · Use of Externally-Controlled Format String
Published
2022-08-04T09:35Z
EPSS history
Timeline
  • 04 AUG 09:35Z
    Use of Externally-Controlled Format String in umlaeute/v4l2loopback
    cvelistv5