CVE-2022-42895

Severity CVSS v4.0:

Pending analysis

Type:

CWE-824 Access of Uninitialized Pointer

Publication date:

23/11/2022

Last modified:

07/11/2023

Description

There is an infoleak vulnerability in the Linux kernel&#39;s net/bluetooth/l2cap_core.c&#39;s l2cap_parse_conf_req function which can be used to leak kernel pointers remotely.<br /> We recommend upgrading past commit https://github.com/torvalds/linux/commit/b1a2cd50c0357f243b7435a732b4e62ba3157a2e https://www.google.com/url <br /> <br />

Impact

Vector 3.x

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS v3.1 Severity and Metrics:

Base Score: 6.50 MEDIUM
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector (AV): Adjacent
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): None
Availability (A): None