CVE-2022-2652 Use of Externally-Controlled Format String in umlaeute/v4l2loopback
Crafted format strings in v4l2loopback card labels allow attackers to leak kernel stack memory and cause denial of service via module crashes.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-2652?
CVE-2022-2652 is a high-severity vulnerability in umlaeute/v4l2loopback, published on 4 Aug 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).
Weakness: CWE-134
Which versions are affected by CVE-2022-2652?
It affects 1 product.
Linux distribution packages (2)
v4l2loopback openSUSE:Leap 15.3 | All versions | 0.12.5-lp153.2.5.1 |
v4l2loopback openSUSE:Leap 15.4 | All versions | 0.12.5-lp154.3.3.1 |
Products include V4l2loopback Project V4l2loopback.
How do I fix CVE-2022-2652?
Apply the vendor's patch.
Is CVE-2022-2652 being exploited?
There is no known exploitation of CVE-2022-2652 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-2652, GHSA-grx9-955g-vjfg, UBUNTU-CVE-2022-2652, openSUSE-SU-2022:10159-1, openSUSE-SU-2022:10160-1, openSUSE-SU-2024:12372-1.