Vulnerability in Umlaeute Umlaeute/v4l2loopback
CVE-2022-2652
Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).
EPSS: 0.003 (24.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.0 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H.
Affected products
- Umlaeute Umlaeute/v4l2loopback — versions unspecified
- V4l2loopback_project V4l2loopback
Weakness classification (CWE)
References
- security@huntr.dev (x_refsource_CONFIRM, Exploit, Patch, Third Party Advisory, Issue Tracking)
- security@huntr.dev (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2022-2652?
- CVE-2022-2652 is a medium-severity vulnerability in Umlaeute Umlaeute/v4l2loopback, classified under Use of Externally-Controlled Format String. CVSS score: 6.0/10. Published 2022-08-04.
- How severe is CVE-2022-2652?
- Medium severity. CVSS v3 base score is 6.0 out of 10.