CVE-2022-48947
published 2024-10-21CVE-2022-48947: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix u8 overflow By keep sending L2CAP_CONF_REQ packets…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.25%
16.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix u8 overflow
By keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases
multiple times and eventually it will wrap around the maximum number
(i.e., 255).
This patch prevents this by adding a boundary check with
L2CAP_MAX_CONF_RSP
Btmon log:
Bluetooth monitor ver 5.64
= Note: Linux version 6.1.0-rc2 (x86_64) 0.264594
= Note: Bluetooth subsystem version 2.22 0.264636
@ MGMT Open: btmon (privileged) version 1.22 {0x0001} 0.272191
= New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0) [hci0] 13.877604
@ RAW Open: 9496 (privileged) version 2.22 {0x0002} 13.890741
= Open Index: 00:00:00:00:00:00 [hci0] 13.900426
(...)
> ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 14.273106
invalid packet size (12 != 1033)
08 00 01 00 02 01 04 00 01 10 ff ff ............
> ACL Data RX: Handle 200 flags 0x00 dlen 1547 #33 [hci0] 14.273561
invalid packet size (14 != 1547)
0a 00 01 00 04 01 06 00 40 00 00 00 00 00 ........@.....
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #34 [hci0] 14.274390
invalid packet size (16 != 2061)
0c 00 01 00 04 01 08 00 40 00 00 00 00 00 00 04 ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 2061 #35 [hci0] 14.274932
invalid packet size (16 != 2061)
0c 00 01 00 04 01 08 00 40 00 00 00 07 00 03 00 ........@.......
= bluetoothd: Bluetooth daemon 5.43 14.401828
> ACL Data RX: Handle 200 flags 0x00 dlen 1033 #36 [hci0] 14.275753
invalid packet size (12 != 1033)
08 00 01 00 04 01 04 00 40 00 00 00 ........@...
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.4-1 (bookworm) | linux 6.1.4-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= f2fcfcd670257236ebf2088bbdf26f6a8ef459fe < 49d5867819ab7c744852b45509e8469839c07e0e | 49d5867819ab7c744852b45509e8469839c07e0e |
| linux | linux | >= f2fcfcd670257236ebf2088bbdf26f6a8ef459fe < 95f1847a361c7b4bf7d74c06ecb6968455082c1a | 95f1847a361c7b4bf7d74c06ecb6968455082c1a |
| linux | linux | >= f2fcfcd670257236ebf2088bbdf26f6a8ef459fe < ad528fde0702903208d0a79d88d5a42ae3fc235b | ad528fde0702903208d0a79d88d5a42ae3fc235b |
| linux | linux | >= f2fcfcd670257236ebf2088bbdf26f6a8ef459fe < 9fdc79b571434af7bc742da40a3405f038b637a7 | 9fdc79b571434af7bc742da40a3405f038b637a7 |
| linux | linux | >= f2fcfcd670257236ebf2088bbdf26f6a8ef459fe < f3fe6817156a2ad4b06f01afab04638a34d7c9a6 | f3fe6817156a2ad4b06f01afab04638a34d7c9a6 |
| linux | linux | >= f2fcfcd670257236ebf2088bbdf26f6a8ef459fe < 19a78143961a197de8502f4f29c453b913dc3c29 | 19a78143961a197de8502f4f29c453b913dc3c29 |
| linux | linux | >= f2fcfcd670257236ebf2088bbdf26f6a8ef459fe < 5550bbf709c323194881737fd290c4bada9e6ead | 5550bbf709c323194881737fd290c4bada9e6ead |
| linux | linux | >= f2fcfcd670257236ebf2088bbdf26f6a8ef459fe < bcd70260ef56e0aee8a4fc6cd214a419900b0765 | bcd70260ef56e0aee8a4fc6cd214a419900b0765 |
| linux | linux_kernel | < 4.9.337 | 4.9.337 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.162-1 | 5.10.162-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 4.10 < 4.14.303 | 4.14.303 |
| linux | linux_kernel | >= 4.15 < 4.19.270 | 4.19.270 |
| linux | linux_kernel | >= 4.20 < 5.4.229 | 5.4.229 |
| linux | linux_kernel | >= 5.11 < 5.15.85 | 5.15.85 |
| linux | linux_kernel | >= 5.16 < 6.0.15 | 6.0.15 |
| linux | linux_kernel | >= 5.5 < 5.10.161 | 5.10.161 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: Bluetooth: L2CAP: Fix u8 overflow
vendor_redhat·2024-10-21·CVSS 5.5
CVE-2022-48947 [MEDIUM] CWE-190 kernel: Bluetooth: L2CAP: Fix u8 overflow
kernel: Bluetooth: L2CAP: Fix u8 overflow
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix u8 overflow
By keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases
multiple times and eventually it will wrap around the maximum number
(i.e., 255).
This patch prevents this by adding a boundary check with
L2CAP_MAX_CONF_RSP
Btmon log:
Bluetooth monitor ver 5.64
= Note: Linux version 6.1.0-rc2 (x86_64) 0.264594
= Note: Bluetooth subsystem version 2.22 0.264636
@ MGMT Open: btmon (privileged) version 1.22 {0x0001} 0.272191
= New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0) [hci0] 13.877604
@ RAW Open: 9496 (privileged) version 2.22 {0x0002} 13.890741
= Open Index: 00:00:00:00:00:00 [hci0] 13.900426
(...)
> ACL Data RX: Handle 200 flags 0x00 dl
Debian
CVE-2022-48947: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ...
vendor_debian·2022·CVSS 5.5
CVE-2022-48947 [MEDIUM] CVE-2022-48947: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ...
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix u8 overflow By keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases multiple times and eventually it will wrap around the maximum number (i.e., 255). This patch prevents this by adding a boundary check with L2CAP_MAX_CONF_RSP Btmon log: Bluetooth monitor ver 5.64 = Note: Linux version 6.1.0-rc2 (x86_64) 0.264594 = Note: Bluetooth subsystem version 2.22 0.264636 @ MGMT Open: btmon (privileged) version 1.22 {0x0001} 0.272191 = New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0) [hci0] 13.877604 @ RAW Open: 9496 (privileged) version 2.22 {0x0002} 13.890741 = Open Index: 00:00:00:00:00:00 [hci0] 13.900426 (...) > ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 14.273106 invalid packet
OSV
CVE-2022-48947: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix u8 overflow By keep sending L2CAP_CONF_REQ packets, chan->nu
osv·2024-10-21·CVSS 5.5
CVE-2022-48947 [MEDIUM] CVE-2022-48947: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix u8 overflow By keep sending L2CAP_CONF_REQ packets, chan->nu
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix u8 overflow By keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases multiple times and eventually it will wrap around the maximum number (i.e., 255). This patch prevents this by adding a boundary check with L2CAP_MAX_CONF_RSP Btmon log: Bluetooth monitor ver 5.64 = Note: Linux version 6.1.0-rc2 (x86_64) 0.264594 = Note: Bluetooth subsystem version 2.22 0.264636 @ MGMT Open: btmon (privileged) version 1.22 {0x0001} 0.272191 = New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0) [hci0] 13.877604 @ RAW Open: 9496 (privileged) version 2.22 {0x0002} 13.890741 = Open Index: 00:00:00:00:00:00 [hci0] 13.900426 (...) > ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 14.273106 invalid packet
GHSA
GHSA-gp53-q766-mxq2: In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix u8 overflow
By keep sending L2CAP_CONF_REQ packets, chan->
ghsa_unreviewed·2024-10-21
CVE-2022-48947 [MEDIUM] CWE-190 GHSA-gp53-q766-mxq2: In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix u8 overflow
By keep sending L2CAP_CONF_REQ packets, chan->
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix u8 overflow
By keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases
multiple times and eventually it will wrap around the maximum number
(i.e., 255).
This patch prevents this by adding a boundary check with
L2CAP_MAX_CONF_RSP
Btmon log:
Bluetooth monitor ver 5.64
= Note: Linux version 6.1.0-rc2 (x86_64) 0.264594
= Note: Bluetooth subsystem version 2.22 0.264636
@ MGMT Open: btmon (privileged) version 1.22 {0x0001} 0.272191
= New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0) [hci0] 13.877604
@ RAW Open: 9496 (privileged) version 2.22 {0x0002} 13.890741
= Open Index: 00:00:00:00:00:00 [hci0] 13.900426
(...)
> ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 14.273106
invalid pac
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/19a78143961a197de8502f4f29c453b913dc3c29https://git.kernel.org/stable/c/49d5867819ab7c744852b45509e8469839c07e0ehttps://git.kernel.org/stable/c/5550bbf709c323194881737fd290c4bada9e6eadhttps://git.kernel.org/stable/c/95f1847a361c7b4bf7d74c06ecb6968455082c1ahttps://git.kernel.org/stable/c/9fdc79b571434af7bc742da40a3405f038b637a7https://git.kernel.org/stable/c/ad528fde0702903208d0a79d88d5a42ae3fc235bhttps://git.kernel.org/stable/c/bcd70260ef56e0aee8a4fc6cd214a419900b0765https://git.kernel.org/stable/c/f3fe6817156a2ad4b06f01afab04638a34d7c9a6
2024-10-21
Published