CVE-2022-42895CWE-824

CVE-2022-42895

Medium · published November 23, 2022

CVSS v3.1
5.1
EPSS
0%
Percentile
39.9
In the wild
Unconfirmed
What it is

There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely.

We recommend upgrading past commit  https://github.com/torvalds/linux/commit/b1a2cd50c0357f243b7435a732b4e62ba3157a2e https://www.google.com/url

The record
Technical detail
CVSS v3.1
5.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00473 · 39.9th percentile
Weakness
CWE-824 · Access of Uninitialized Pointer
Published
2022-11-23T20:15Z
Affected products (1)
ProductVersionsFixed in
linux/linux_kernelall versions—
References (5)
https://github.com/torvalds/linux/commit/b1a2cd50c0357f243b7435a732b4e62ba3157a2e · [email protected]https://kernel.dance/#b1a2cd50c0357f243b7435a732b4e62ba3157a2e · [email protected]https://github.com/torvalds/linux/commit/b1a2cd50c0357f243b7435a732b4e62ba3157a2e · af854a3a-2127-422b-91ae-364da2661108https://kernel.dance/#b1a2cd50c0357f243b7435a732b4e62ba3157a2e · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-794697.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 23 NOV 14:11Z
    Info Leak in l2cap_core in the Linux Kernel
    cvelistv5