CVE-2022-48947

MEDIUM EPSS 15.7%

Published Oct 21, 20241y ago · Modified Jun 17, 20262w ago

5.5 CVSS 3.1

Medium

Published Oct 21, 2024 1y ago

Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix u8 overflow By keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases multiple times and eventually it will wrap around the maximum number (i.e., 255). This patch prevents this by adding a boundary check with L2CAP_MAX_CONF_RSP Btmon log: Bluetooth monitor ver 5.64 = Note: Linux version 6.1.0-rc2 (x86_64) 0.264594 = Note: Bluetooth subsystem version 2.22 0.264636 @ MGMT Open: btmon (privileged) version 1.22 {0x0001} 0.272191 = New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0) [hci0] 13.877604 @ RAW Open: 9496 (privileged) version 2.22 {0x0002} 13.890741 = Open Index: 00:00:00:00:00:00 [hci0] 13.900426 (...) > ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 14.273106 invalid packet size (12 != 1033) 08 00 01 00 02 01 04 00 01 10 ff ff ............ > ACL Data RX: Handle 200 flags 0x00 dlen 1547 #33 [hci0] 14.273561 invalid packet size (14 != 1547) 0a 00 01 00 04 01 06 00 40 00 00 00 00 00 ........@..... > ACL Data RX: Handle 200 flags 0x00 dlen 2061 #34 [hci0] 14.274390 invalid packet size (16 != 2061) 0c 00 01 00 04 01 08 00 40 00 00 00 00 00 00 04 ........@....... > ACL Data RX: Handle 200 flags 0x00 dlen 2061 #35 [hci0] 14.274932 invalid packet size (16 != 2061) 0c 00 01 00 04 01 08 00 40 00 00 00 07 00 03 00 ........@....... = bluetoothd: Bluetooth daemon 5.43 14.401828 > ACL Data RX: Handle 200 flags 0x00 dlen 1033 #36 [hci0] 14.275753 invalid packet size (12 != 1033) 08 00 01 00 04 01 04 00 40 00 00 00 ........@...

CVSS Details

Base Score

5.5

Exploitability

1.8

Impact

3.6

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability High

Threat Intelligence

EPSS Exploit Probability

15.7% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-190 Integer Overflow or Wraparound Numeric Error

Affected Products 15

Vendor	Product	Version	Range
linux	linux_kernel	*	<4.9.337
linux	linux_kernel	*	≥4.10 – <4.14.303
linux	linux_kernel	*	≥4.15 – <4.19.270
linux	linux_kernel	*	≥4.20 – <5.4.229
linux	linux_kernel	*	≥5.5 – <5.10.161
linux	linux_kernel	*	≥5.11 – <5.15.85
linux	linux_kernel	*	≥5.16 – <6.0.15
linux	linux_kernel	6.1	any
linux	linux_kernel	6.1	any
linux	linux_kernel	6.1	any
linux	linux_kernel	6.1	any
linux	linux_kernel	6.1	any
linux	linux_kernel	6.1	any
linux	linux_kernel	6.1	any
linux	linux_kernel	6.1	any

References 8

git.kernel.org https://git.kernel.org/stable/c/19a78143961a197de8502f4f29c453b913dc3c29

Patch
git.kernel.org https://git.kernel.org/stable/c/49d5867819ab7c744852b45509e8469839c07e0e

Patch
git.kernel.org https://git.kernel.org/stable/c/5550bbf709c323194881737fd290c4bada9e6ead

Patch
git.kernel.org https://git.kernel.org/stable/c/95f1847a361c7b4bf7d74c06ecb6968455082c1a

Patch
git.kernel.org https://git.kernel.org/stable/c/9fdc79b571434af7bc742da40a3405f038b637a7

Patch
git.kernel.org https://git.kernel.org/stable/c/ad528fde0702903208d0a79d88d5a42ae3fc235b

Patch
git.kernel.org https://git.kernel.org/stable/c/bcd70260ef56e0aee8a4fc6cd214a419900b0765

Patch
git.kernel.org https://git.kernel.org/stable/c/f3fe6817156a2ad4b06f01afab04638a34d7c9a6

Patch

Remediation

git.kernel.org https://git.kernel.org/stable/c/19a78143961a197de8502f4f29c453b913dc3c29

Patch
git.kernel.org https://git.kernel.org/stable/c/49d5867819ab7c744852b45509e8469839c07e0e

Patch
git.kernel.org https://git.kernel.org/stable/c/5550bbf709c323194881737fd290c4bada9e6ead

Patch
git.kernel.org https://git.kernel.org/stable/c/95f1847a361c7b4bf7d74c06ecb6968455082c1a

Patch
git.kernel.org https://git.kernel.org/stable/c/9fdc79b571434af7bc742da40a3405f038b637a7

Patch
git.kernel.org https://git.kernel.org/stable/c/ad528fde0702903208d0a79d88d5a42ae3fc235b

Patch
git.kernel.org https://git.kernel.org/stable/c/bcd70260ef56e0aee8a4fc6cd214a419900b0765

Patch
git.kernel.org https://git.kernel.org/stable/c/f3fe6817156a2ad4b06f01afab04638a34d7c9a6

Patch