Search
Find a vulnerability
Search criteria
2 vulnerabilities by umlaeute
CVE-2022-2652 (GCVE-0-2022-2652)
Vulnerability from nvd – Published: 2022-08-04 09:35 – Updated: 2024-08-03 00:46
VLAI
Title
Use of Externally-Controlled Format String in umlaeute/v4l2loopback
Summary
Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).
Severity
7.3 (High)
CWE
- CWE-134 - Use of Externally-Controlled Format String
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://huntr.dev/bounties/1b055da5-7a9e-4409-99d… | x_refsource_CONFIRM |
| https://github.com/umlaeute/v4l2loopback/commit/e… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| umlaeute | umlaeute/v4l2loopback |
Affected:
unspecified , < 0.12.6
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:46:03.489Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/1b055da5-7a9e-4409-99d7-030280d242d5"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/umlaeute/v4l2loopback/commit/e4cd225557486c420f6a34411f98c575effd43dd"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "umlaeute/v4l2loopback",
"vendor": "umlaeute",
"versions": [
{
"lessThan": "0.12.6",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Depending on the way the format strings in the card label are crafted it\u0027s possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row)."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "CWE-134 Use of Externally-Controlled Format String",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-04T09:35:37.000Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/1b055da5-7a9e-4409-99d7-030280d242d5"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/umlaeute/v4l2loopback/commit/e4cd225557486c420f6a34411f98c575effd43dd"
}
],
"source": {
"advisory": "1b055da5-7a9e-4409-99d7-030280d242d5",
"discovery": "EXTERNAL"
},
"title": "Use of Externally-Controlled Format String in umlaeute/v4l2loopback",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2022-2652",
"STATE": "PUBLIC",
"TITLE": "Use of Externally-Controlled Format String in umlaeute/v4l2loopback"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "umlaeute/v4l2loopback",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "0.12.6"
}
]
}
}
]
},
"vendor_name": "umlaeute"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Depending on the way the format strings in the card label are crafted it\u0027s possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row)."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-134 Use of Externally-Controlled Format String"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/1b055da5-7a9e-4409-99d7-030280d242d5",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/1b055da5-7a9e-4409-99d7-030280d242d5"
},
{
"name": "https://github.com/umlaeute/v4l2loopback/commit/e4cd225557486c420f6a34411f98c575effd43dd",
"refsource": "MISC",
"url": "https://github.com/umlaeute/v4l2loopback/commit/e4cd225557486c420f6a34411f98c575effd43dd"
}
]
},
"source": {
"advisory": "1b055da5-7a9e-4409-99d7-030280d242d5",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-2652",
"datePublished": "2022-08-04T09:35:37.000Z",
"dateReserved": "2022-08-04T00:00:00.000Z",
"dateUpdated": "2024-08-03T00:46:03.489Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-2652 (GCVE-0-2022-2652)
Vulnerability from cvelistv5 – Published: 2022-08-04 09:35 – Updated: 2024-08-03 00:46
VLAI
Title
Use of Externally-Controlled Format String in umlaeute/v4l2loopback
Summary
Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).
Severity
7.3 (High)
CWE
- CWE-134 - Use of Externally-Controlled Format String
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://huntr.dev/bounties/1b055da5-7a9e-4409-99d… | x_refsource_CONFIRM |
| https://github.com/umlaeute/v4l2loopback/commit/e… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| umlaeute | umlaeute/v4l2loopback |
Affected:
unspecified , < 0.12.6
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:46:03.489Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/1b055da5-7a9e-4409-99d7-030280d242d5"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/umlaeute/v4l2loopback/commit/e4cd225557486c420f6a34411f98c575effd43dd"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "umlaeute/v4l2loopback",
"vendor": "umlaeute",
"versions": [
{
"lessThan": "0.12.6",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Depending on the way the format strings in the card label are crafted it\u0027s possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row)."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "CWE-134 Use of Externally-Controlled Format String",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-04T09:35:37.000Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/1b055da5-7a9e-4409-99d7-030280d242d5"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/umlaeute/v4l2loopback/commit/e4cd225557486c420f6a34411f98c575effd43dd"
}
],
"source": {
"advisory": "1b055da5-7a9e-4409-99d7-030280d242d5",
"discovery": "EXTERNAL"
},
"title": "Use of Externally-Controlled Format String in umlaeute/v4l2loopback",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2022-2652",
"STATE": "PUBLIC",
"TITLE": "Use of Externally-Controlled Format String in umlaeute/v4l2loopback"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "umlaeute/v4l2loopback",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "0.12.6"
}
]
}
}
]
},
"vendor_name": "umlaeute"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Depending on the way the format strings in the card label are crafted it\u0027s possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row)."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-134 Use of Externally-Controlled Format String"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/1b055da5-7a9e-4409-99d7-030280d242d5",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/1b055da5-7a9e-4409-99d7-030280d242d5"
},
{
"name": "https://github.com/umlaeute/v4l2loopback/commit/e4cd225557486c420f6a34411f98c575effd43dd",
"refsource": "MISC",
"url": "https://github.com/umlaeute/v4l2loopback/commit/e4cd225557486c420f6a34411f98c575effd43dd"
}
]
},
"source": {
"advisory": "1b055da5-7a9e-4409-99d7-030280d242d5",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-2652",
"datePublished": "2022-08-04T09:35:37.000Z",
"dateReserved": "2022-08-04T00:00:00.000Z",
"dateUpdated": "2024-08-03T00:46:03.489Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}