Vulnerability-Lookup

FKIE_CVE-2022-48947

Vulnerability from fkie_nvd - Published: 2024-10-21 20:15 - Updated: 2026-06-17 05:16

Severity

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix u8 overflow By keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases multiple times and eventually it will wrap around the maximum number (i.e., 255). This patch prevents this by adding a boundary check with L2CAP_MAX_CONF_RSP Btmon log: Bluetooth monitor ver 5.64 = Note: Linux version 6.1.0-rc2 (x86_64) 0.264594 = Note: Bluetooth subsystem version 2.22 0.264636 @ MGMT Open: btmon (privileged) version 1.22 {0x0001} 0.272191 = New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0) [hci0] 13.877604 @ RAW Open: 9496 (privileged) version 2.22 {0x0002} 13.890741 = Open Index: 00:00:00:00:00:00 [hci0] 13.900426 (...) > ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 14.273106 invalid packet size (12 != 1033) 08 00 01 00 02 01 04 00 01 10 ff ff ............ > ACL Data RX: Handle 200 flags 0x00 dlen 1547 #33 [hci0] 14.273561 invalid packet size (14 != 1547) 0a 00 01 00 04 01 06 00 40 00 00 00 00 00 ........@..... > ACL Data RX: Handle 200 flags 0x00 dlen 2061 #34 [hci0] 14.274390 invalid packet size (16 != 2061) 0c 00 01 00 04 01 08 00 40 00 00 00 00 00 00 04 ........@....... > ACL Data RX: Handle 200 flags 0x00 dlen 2061 #35 [hci0] 14.274932 invalid packet size (16 != 2061) 0c 00 01 00 04 01 08 00 40 00 00 00 07 00 03 00 ........@....... = bluetoothd: Bluetooth daemon 5.43 14.401828 > ACL Data RX: Handle 200 flags 0x00 dlen 1033 #36 [hci0] 14.275753 invalid packet size (12 != 1033) 08 00 01 00 04 01 04 00 40 00 00 00 ........@...

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/19a78143961a197de8502f4f29c453b913dc3c29	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/49d5867819ab7c744852b45509e8469839c07e0e	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5550bbf709c323194881737fd290c4bada9e6ead	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/95f1847a361c7b4bf7d74c06ecb6968455082c1a	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/9fdc79b571434af7bc742da40a3405f038b637a7	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ad528fde0702903208d0a79d88d5a42ae3fc235b	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/bcd70260ef56e0aee8a4fc6cd214a419900b0765	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/f3fe6817156a2ad4b06f01afab04638a34d7c9a6	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	6.1
linux	linux_kernel	6.1
linux	linux_kernel	6.1
linux	linux_kernel	6.1
linux	linux_kernel	6.1
linux	linux_kernel	6.1
linux	linux_kernel	6.1
linux	linux_kernel	6.1

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "49d5867819ab7c744852b45509e8469839c07e0e",
              "status": "affected",
              "version": "f2fcfcd670257236ebf2088bbdf26f6a8ef459fe",
              "versionType": "git"
            },
            {
              "lessThan": "95f1847a361c7b4bf7d74c06ecb6968455082c1a",
              "status": "affected",
              "version": "f2fcfcd670257236ebf2088bbdf26f6a8ef459fe",
              "versionType": "git"
            },
            {
              "lessThan": "ad528fde0702903208d0a79d88d5a42ae3fc235b",
              "status": "affected",
              "version": "f2fcfcd670257236ebf2088bbdf26f6a8ef459fe",
              "versionType": "git"
            },
            {
              "lessThan": "9fdc79b571434af7bc742da40a3405f038b637a7",
              "status": "affected",
              "version": "f2fcfcd670257236ebf2088bbdf26f6a8ef459fe",
              "versionType": "git"
            },
            {
              "lessThan": "f3fe6817156a2ad4b06f01afab04638a34d7c9a6",
              "status": "affected",
              "version": "f2fcfcd670257236ebf2088bbdf26f6a8ef459fe",
              "versionType": "git"
            },
            {
              "lessThan": "19a78143961a197de8502f4f29c453b913dc3c29",
              "status": "affected",
              "version": "f2fcfcd670257236ebf2088bbdf26f6a8ef459fe",
              "versionType": "git"
            },
            {
              "lessThan": "5550bbf709c323194881737fd290c4bada9e6ead",
              "status": "affected",
              "version": "f2fcfcd670257236ebf2088bbdf26f6a8ef459fe",
              "versionType": "git"
            },
            {
              "lessThan": "bcd70260ef56e0aee8a4fc6cd214a419900b0765",
              "status": "affected",
              "version": "f2fcfcd670257236ebf2088bbdf26f6a8ef459fe",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.32"
            },
            {
              "lessThan": "2.6.32",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.337",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.303",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.85",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9FFBA9B5-26DC-4802-9A86-F7B886954E4A",
              "versionEndExcluding": "4.9.337",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1E7450AD-4739-46F0-B81B-C02E7B35A97B",
              "versionEndExcluding": "4.14.303",
              "versionStartIncluding": "4.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AE8904A3-99BE-4E49-9682-1F90A6373F4F",
              "versionEndExcluding": "4.19.270",
              "versionStartIncluding": "4.15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A0C0D95E-414A-445E-941B-3EF6A4D3A093",
              "versionEndExcluding": "5.4.229",
              "versionStartIncluding": "4.20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6CD83369-DB79-46EF-B731-E327A63A4E1B",
              "versionEndExcluding": "5.10.161",
              "versionStartIncluding": "5.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E0D49B1E-E996-4A13-9C5C-23C64BBD0E0F",
              "versionEndExcluding": "5.15.85",
              "versionStartIncluding": "5.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3E66ABBB-C60E-481F-88C6-ED81661DFC31",
              "versionEndExcluding": "6.0.15",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "17F0B248-42CF-4AE6-A469-BB1BAE7F4705",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "E2422816-0C14-4B5E-A1E6-A9D776E5C49B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "35B26BE4-43A6-4A36-A7F6-5B3F572D9186",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*",
              "matchCriteriaId": "3FFFB0B3-930D-408A-91E2-BAE0C2715D80",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*",
              "matchCriteriaId": "8535320E-A0DB-4277-800E-D0CE5BBA59E8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:*",
              "matchCriteriaId": "21718AA4-4056-40F2-968E-BDAA465A7872",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix u8 overflow\n\nBy keep sending L2CAP_CONF_REQ packets, chan-\u003enum_conf_rsp increases\nmultiple times and eventually it will wrap around the maximum number\n(i.e., 255).\nThis patch prevents this by adding a boundary check with\nL2CAP_MAX_CONF_RSP\n\nBtmon log:\nBluetooth monitor ver 5.64\n= Note: Linux version 6.1.0-rc2 (x86_64)                               0.264594\n= Note: Bluetooth subsystem version 2.22                               0.264636\n@ MGMT Open: btmon (privileged) version 1.22                  {0x0001} 0.272191\n= New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0)          [hci0] 13.877604\n@ RAW Open: 9496 (privileged) version 2.22                   {0x0002} 13.890741\n= Open Index: 00:00:00:00:00:00                                [hci0] 13.900426\n(...)\n\u003e ACL Data RX: Handle 200 flags 0x00 dlen 1033             #32 [hci0] 14.273106\n        invalid packet size (12 != 1033)\n        08 00 01 00 02 01 04 00 01 10 ff ff              ............\n\u003e ACL Data RX: Handle 200 flags 0x00 dlen 1547             #33 [hci0] 14.273561\n        invalid packet size (14 != 1547)\n        0a 00 01 00 04 01 06 00 40 00 00 00 00 00        ........@.....\n\u003e ACL Data RX: Handle 200 flags 0x00 dlen 2061             #34 [hci0] 14.274390\n        invalid packet size (16 != 2061)\n        0c 00 01 00 04 01 08 00 40 00 00 00 00 00 00 04  ........@.......\n\u003e ACL Data RX: Handle 200 flags 0x00 dlen 2061             #35 [hci0] 14.274932\n        invalid packet size (16 != 2061)\n        0c 00 01 00 04 01 08 00 40 00 00 00 07 00 03 00  ........@.......\n= bluetoothd: Bluetooth daemon 5.43                                   14.401828\n\u003e ACL Data RX: Handle 200 flags 0x00 dlen 1033             #36 [hci0] 14.275753\n        invalid packet size (12 != 1033)\n        08 00 01 00 04 01 04 00 40 00 00 00              ........@..."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: L2CAP: Corregir desbordamiento de u8 Al seguir enviando paquetes L2CAP_CONF_REQ, chan-\u0026gt;num_conf_rsp aumenta varias veces y eventualmente alcanzar\u00e1 el n\u00famero m\u00e1ximo (es decir, 255). Este parche evita esto a\u00f1adiendo una comprobaci\u00f3n de los l\u00edmites con L2CAP_MAX_CONF_RSP Btmon log: Bluetooth monitor ver 5.64 = Nota: Linux versi\u00f3n 6.1.0-rc2 (x86_64) 0.264594 = Nota: Subsistema Bluetooth versi\u00f3n 2.22 0.264636 @ MGMT Open: btmon (privilegiado) versi\u00f3n 1.22 {0x0001} 0.272191 = Nuevo \u00edndice: 00:00:00:00:00:00 (Principal,Virtual,hci0) [hci0] 13.877604 @ RAW Open: 9496 (privilegiado) versi\u00f3n 2.22 {0x0002} 13.890741 = Abierto \u00cdndice: 00:00:00:00:00:00 [hci0] 13.900426 (...) \u0026gt; ACL Data RX: Manejar 200 indicadores 0x00 dlen 1033 #32 [hci0] 14.273106 tama\u00f1o de paquete no v\u00e1lido (12 != 1033) 08 00 01 00 02 01 04 00 01 10 ff ff ............ \u0026gt; ACL Data RX: Manejar 200 indicadores 0x00 dlen 1547 #33 [hci0] 14.273561 tama\u00f1o de paquete no v\u00e1lido (14 != 1547) 0a 00 01 00 04 01 06 00 40 00 00 00 00 00 ........@..... \u0026gt; ACL Data RX: Manejar 200 indicadores 0x00 dlen 2061 #34 [hci0] 14.274390 tama\u00f1o de paquete no v\u00e1lido (16 != 2061) 0c 00 01 00 04 01 08 00 40 00 00 00 00 00 00 04 ........@....... \u0026gt; ACL Data RX: Manejar 200 indicadores 0x00 dlen 2061 #35 [hci0] 14.274932 tama\u00f1o de paquete no v\u00e1lido (16 != 2061) 0c 00 01 00 04 01 08 00 40 00 00 00 07 00 03 00 ........@....... = bluetoothd: Daemon Bluetooth 5.43 14.401828 \u0026gt; ACL Data RX: Manejar 200 indicadores 0x00 dlen 1033 #36 [hci0] 14.275753 tama\u00f1o de paquete no v\u00e1lido (12 != 1033) 08 00 01 00 04 01 04 00 40 00 00 00 ........@..."
    }
  ],
  "id": "CVE-2022-48947",
  "lastModified": "2026-06-17T05:16:41.207",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-48947",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-10-22T13:22:07.757358Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-10-21T20:15:06.150",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/19a78143961a197de8502f4f29c453b913dc3c29"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/49d5867819ab7c744852b45509e8469839c07e0e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/5550bbf709c323194881737fd290c4bada9e6ead"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/95f1847a361c7b4bf7d74c06ecb6968455082c1a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/9fdc79b571434af7bc742da40a3405f038b637a7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/ad528fde0702903208d0a79d88d5a42ae3fc235b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/bcd70260ef56e0aee8a4fc6cd214a419900b0765"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/f3fe6817156a2ad4b06f01afab04638a34d7c9a6"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2022-48947 (GCVE-0-2022-48947)

Vulnerability from cvelistv5 – Published: 2024-10-21 20:05 – Updated: 2026-05-11 18:50

Title

Bluetooth: L2CAP: Fix u8 overflow

Summary

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-22 13:22 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/49d5867819ab7c744…
https://git.kernel.org/stable/c/95f1847a361c7b4bf…
https://git.kernel.org/stable/c/ad528fde070290320…
https://git.kernel.org/stable/c/9fdc79b571434af7b…
https://git.kernel.org/stable/c/f3fe6817156a2ad4b…
https://git.kernel.org/stable/c/19a78143961a197de…
https://git.kernel.org/stable/c/5550bbf709c323194…
https://git.kernel.org/stable/c/bcd70260ef56e0aee…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f2fcfcd670257236ebf2088bbdf26f6a8ef459fe , < 49d5867819ab7c744852b45509e8469839c07e0e (git) Affected: f2fcfcd670257236ebf2088bbdf26f6a8ef459fe , < 95f1847a361c7b4bf7d74c06ecb6968455082c1a (git) Affected: f2fcfcd670257236ebf2088bbdf26f6a8ef459fe , < ad528fde0702903208d0a79d88d5a42ae3fc235b (git) Affected: f2fcfcd670257236ebf2088bbdf26f6a8ef459fe , < 9fdc79b571434af7bc742da40a3405f038b637a7 (git) Affected: f2fcfcd670257236ebf2088bbdf26f6a8ef459fe , < f3fe6817156a2ad4b06f01afab04638a34d7c9a6 (git) Affected: f2fcfcd670257236ebf2088bbdf26f6a8ef459fe , < 19a78143961a197de8502f4f29c453b913dc3c29 (git) Affected: f2fcfcd670257236ebf2088bbdf26f6a8ef459fe , < 5550bbf709c323194881737fd290c4bada9e6ead (git) Affected: f2fcfcd670257236ebf2088bbdf26f6a8ef459fe , < bcd70260ef56e0aee8a4fc6cd214a419900b0765 (git)
Linux	Linux	Affected: 2.6.32 Unaffected: 0 , < 2.6.32 (semver) Unaffected: 4.9.337 , ≤ 4.9.* (semver) Unaffected: 4.14.303 , ≤ 4.14.* (semver) Unaffected: 4.19.270 , ≤ 4.19.* (semver) Unaffected: 5.4.229 , ≤ 5.4.* (semver) Unaffected: 5.10.161 , ≤ 5.10.* (semver) Unaffected: 5.15.85 , ≤ 5.15.* (semver) Unaffected: 6.0.15 , ≤ 6.0.* (semver) Unaffected: 6.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48947",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:22:07.757358Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:28:41.276Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "49d5867819ab7c744852b45509e8469839c07e0e",
              "status": "affected",
              "version": "f2fcfcd670257236ebf2088bbdf26f6a8ef459fe",
              "versionType": "git"
            },
            {
              "lessThan": "95f1847a361c7b4bf7d74c06ecb6968455082c1a",
              "status": "affected",
              "version": "f2fcfcd670257236ebf2088bbdf26f6a8ef459fe",
              "versionType": "git"
            },
            {
              "lessThan": "ad528fde0702903208d0a79d88d5a42ae3fc235b",
              "status": "affected",
              "version": "f2fcfcd670257236ebf2088bbdf26f6a8ef459fe",
              "versionType": "git"
            },
            {
              "lessThan": "9fdc79b571434af7bc742da40a3405f038b637a7",
              "status": "affected",
              "version": "f2fcfcd670257236ebf2088bbdf26f6a8ef459fe",
              "versionType": "git"
            },
            {
              "lessThan": "f3fe6817156a2ad4b06f01afab04638a34d7c9a6",
              "status": "affected",
              "version": "f2fcfcd670257236ebf2088bbdf26f6a8ef459fe",
              "versionType": "git"
            },
            {
              "lessThan": "19a78143961a197de8502f4f29c453b913dc3c29",
              "status": "affected",
              "version": "f2fcfcd670257236ebf2088bbdf26f6a8ef459fe",
              "versionType": "git"
            },
            {
              "lessThan": "5550bbf709c323194881737fd290c4bada9e6ead",
              "status": "affected",
              "version": "f2fcfcd670257236ebf2088bbdf26f6a8ef459fe",
              "versionType": "git"
            },
            {
              "lessThan": "bcd70260ef56e0aee8a4fc6cd214a419900b0765",
              "status": "affected",
              "version": "f2fcfcd670257236ebf2088bbdf26f6a8ef459fe",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.32"
            },
            {
              "lessThan": "2.6.32",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.337",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.303",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.85",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.337",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.303",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.270",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.229",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.161",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.85",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.15",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix u8 overflow\n\nBy keep sending L2CAP_CONF_REQ packets, chan-\u003enum_conf_rsp increases\nmultiple times and eventually it will wrap around the maximum number\n(i.e., 255).\nThis patch prevents this by adding a boundary check with\nL2CAP_MAX_CONF_RSP\n\nBtmon log:\nBluetooth monitor ver 5.64\n= Note: Linux version 6.1.0-rc2 (x86_64)                               0.264594\n= Note: Bluetooth subsystem version 2.22                               0.264636\n@ MGMT Open: btmon (privileged) version 1.22                  {0x0001} 0.272191\n= New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0)          [hci0] 13.877604\n@ RAW Open: 9496 (privileged) version 2.22                   {0x0002} 13.890741\n= Open Index: 00:00:00:00:00:00                                [hci0] 13.900426\n(...)\n\u003e ACL Data RX: Handle 200 flags 0x00 dlen 1033             #32 [hci0] 14.273106\n        invalid packet size (12 != 1033)\n        08 00 01 00 02 01 04 00 01 10 ff ff              ............\n\u003e ACL Data RX: Handle 200 flags 0x00 dlen 1547             #33 [hci0] 14.273561\n        invalid packet size (14 != 1547)\n        0a 00 01 00 04 01 06 00 40 00 00 00 00 00        ........@.....\n\u003e ACL Data RX: Handle 200 flags 0x00 dlen 2061             #34 [hci0] 14.274390\n        invalid packet size (16 != 2061)\n        0c 00 01 00 04 01 08 00 40 00 00 00 00 00 00 04  ........@.......\n\u003e ACL Data RX: Handle 200 flags 0x00 dlen 2061             #35 [hci0] 14.274932\n        invalid packet size (16 != 2061)\n        0c 00 01 00 04 01 08 00 40 00 00 00 07 00 03 00  ........@.......\n= bluetoothd: Bluetooth daemon 5.43                                   14.401828\n\u003e ACL Data RX: Handle 200 flags 0x00 dlen 1033             #36 [hci0] 14.275753\n        invalid packet size (12 != 1033)\n        08 00 01 00 04 01 04 00 40 00 00 00              ........@..."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:50:13.918Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/49d5867819ab7c744852b45509e8469839c07e0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/95f1847a361c7b4bf7d74c06ecb6968455082c1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad528fde0702903208d0a79d88d5a42ae3fc235b"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fdc79b571434af7bc742da40a3405f038b637a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3fe6817156a2ad4b06f01afab04638a34d7c9a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/19a78143961a197de8502f4f29c453b913dc3c29"
        },
        {
          "url": "https://git.kernel.org/stable/c/5550bbf709c323194881737fd290c4bada9e6ead"
        },
        {
          "url": "https://git.kernel.org/stable/c/bcd70260ef56e0aee8a4fc6cd214a419900b0765"
        }
      ],
      "title": "Bluetooth: L2CAP: Fix u8 overflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48947",
    "datePublished": "2024-10-21T20:05:36.491Z",
    "dateReserved": "2024-08-22T01:27:53.624Z",
    "dateUpdated": "2026-05-11T18:50:13.918Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted