CVE-2022-2652

Katalog CVE

CVSS 6.0 · Medium EPSS 0,33%

Kerentanan Use of Externally-Controlled Format String pada v4l2loopback project v4l2loopback. Skor CVSS 3.1 6.0 (Medium) menurut NVD.

Deskripsi (NVD)

Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).

Rincian

Terbit di NVD

4 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.0 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-134: Use of Externally-Controlled Format String

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/umlaeute/v4l2loopback/commit/e4cd225557486c420f6a34411f98c575effd43dd patch · advisory pihak ketiga
• https://huntr.dev/bounties/1b055da5-7a9e-4409-99d7-030280d242d5 exploit · issue tracking · patch · advisory pihak ketiga