CVE-2022-3563 Linux Kernel BlueZ mgmt-tester.c read_50_controller_cap_complete null pointer dereference

Low 3.5 Published 17 Oct 2022 Updated 15 Apr 2025

A null pointer dereference in the Linux Kernel BlueZ component allows attackers to cause a denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2022-3563?

CVE-2022-3563 is a low-severity vulnerability in Linux Kernel, published on 17 Oct 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function read_50_controller_cap_complete of the file tools/mgmt-tester.c of the component BlueZ. The manipulation of the argument cap_len leads to null pointer dereference. It is recommended to apply a patch to fix this issue. VDB-211086 is the identifier assigned to this vulnerability.

Weakness: CWE-404

Which versions are affected by CVE-2022-3563?

It affects 1 product.

Linux distribution packages (4)

`bluez` SUSE:Linux Enterprise Module for Basesystem 15 SP4	All versions	`5.62-150400.4.8.1`
`bluez` SUSE:Linux Enterprise Module for Desktop Applications 15 SP4	All versions	`5.62-150400.4.8.1`
`bluez` SUSE:Linux Enterprise Workstation Extension 15 SP4	All versions	`5.62-150400.4.8.1`
`bluez` openSUSE:Leap 15.4	All versions	`5.62-150400.4.8.1`

Products include Bluez Bluez.

How do I fix CVE-2022-3563?

Apply the vendor's patch.

Is CVE-2022-3563 being exploited?

There is no known exploitation of CVE-2022-3563 in the wild and no public exploit code.

Sources

Also known as AZL-29945, AZL-34569, DEBIAN-CVE-2022-3563, GHSA-h7mh-ffww-7v4w, SUSE-SU-2023:0167-1, UBUNTU-CVE-2022-3563.