CVE-2022-2652

Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).

CVSS v3 6.0 MEDIUM

6.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/umlaeute/v4l2loopback/commit/e4cd225557486c420f6a34411f98c575effd43dd	Patch Third Party Advisory
https://huntr.dev/bounties/1b055da5-7a9e-4409-99d7-030280d242d5	Exploit Issue Tracking Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:v4l2loopback_project:v4l2loopback:*:*:*:*:*:*:*:*

History

10 Aug 2022, 13:40

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.0
CPE		cpe:2.3:o:v4l2loopback_project:v4l2loopback::::::::
References	~~(MISC) https://github.com/umlaeute/v4l2loopback/commit/e4cd225557486c420f6a34411f98c575effd43dd -~~	(MISC) https://github.com/umlaeute/v4l2loopback/commit/e4cd225557486c420f6a34411f98c575effd43dd - Patch, Third Party Advisory
References	~~(CONFIRM) https://huntr.dev/bounties/1b055da5-7a9e-4409-99d7-030280d242d5 -~~	(CONFIRM) https://huntr.dev/bounties/1b055da5-7a9e-4409-99d7-030280d242d5 - Exploit, Issue Tracking, Patch, Third Party Advisory
First Time		V4l2loopback Project v4l2loopback V4l2loopback Project

04 Aug 2022, 10:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-08-04 10:15

Updated : 2023-12-10 14:35

NVD link : CVE-2022-2652

Mitre link : CVE-2022-2652

CVE.ORG link : CVE-2022-2652

JSON object : View

Products Affected

v4l2loopback_project

v4l2loopback

CWE

CWE-134

Use of Externally-Controlled Format String

{"id": "CVE-2022-2652", "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.3, "exploitabilityScore": 1.5}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.8}]}, "published": "2022-08-04T10:15:07.990", "references": [{"url": "https://github.com/umlaeute/v4l2loopback/commit/e4cd225557486c420f6a34411f98c575effd43dd", "tags": ["Patch", "Third Party Advisory"], "source": "security@huntr.dev"}, {"url": "https://huntr.dev/bounties/1b055da5-7a9e-4409-99d7-030280d242d5", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "source": "security@huntr.dev"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-134"}]}], "descriptions": [{"lang": "en", "value": "Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row)."}, {"lang": "es", "value": "Dependiendo de la forma en que sean dise\u00f1adas las cadenas de formato en la etiqueta de la tarjeta, es posible filtrar la memoria de la pila del kernel. Tambi\u00e9n se presenta la posibilidad de DoS debido a que el m\u00f3dulo del kernel v4l2loopback es bloqueado cuando es proporcionada la etiqueta de la tarjeta a petici\u00f3n (es reproducido, por ejemplo, con muchos modificadores %s en una fila)"}], "lastModified": "2022-08-10T13:40:00.297", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:v4l2loopback_project:v4l2loopback:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80644B02-6794-437D-8E55-1F0BD2763E67", "versionEndExcluding": "0.12.6"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}