Log in Start free

Vulnerability · Published Dec 12, 2022 · Assigned by mitre

CVE-2022-25837

High 7.5

In plain English

A high-severity security flaw in the bluez package (Ubuntu). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 69.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Bluetooth® Pairing in Bluetooth Core Specification v1.0B through v5.3 may permit an unauthenticated MITM to acquire credentials with two pairing devices via adjacent access when at least one device supports BR/EDR Secure Connections pairing and the other BR/EDR Legacy PIN code pairing if the MITM negotiates BR/EDR Secure Simple Pairing in Secure Connections mode using the Passkey association model with the pairing Initiator and BR/EDR Legacy PIN code pairing with the pairing Responder and brute forces the Passkey entered by the user into the Responder as a 6-digit PIN code. The MITM attacker can use the identified PIN code value as the Passkey value to complete authentication with the Initiator via Bluetooth pairing method confusion.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:22.04:LTSbluezno fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSbluezno fix listedUBUNTU-CVE-2022-25837
Ubuntu:25.10bluezno fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinuxno fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinuxno fix listedUBUNTU-CVE-2022-25837
Ubuntu:25.10linuxno fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-awsno fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-awsno fix listedUBUNTU-CVE-2022-25837
Ubuntu:25.10linux-awsno fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-aws-6.17no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-aws-6.8no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-azureno fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-azureno fix listedUBUNTU-CVE-2022-25837
Ubuntu:25.10linux-azureno fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-azure-6.17no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-azure-6.8no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2022-25837
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-azure-fde-6.17no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-azure-fde-6.8no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-gcpno fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-gcpno fix listedUBUNTU-CVE-2022-25837
Ubuntu:25.10linux-gcpno fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-gcp-6.17no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-gcp-6.8no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-gkeopno fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-gkeopno fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-hwe-6.17no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-hwe-6.8no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-ibmno fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-ibmno fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-ibm-6.8no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-intelno fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-intel-iotgno fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-kvmno fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-lowlatencyno fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-lowlatencyno fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.8no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-nvidia-6.8no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-nvidia-lowlatencyno fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-nvidia-tegrano fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-nvidia-tegrano fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-nvidia-tegra-igxno fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-oem-6.17no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-oracleno fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-oracleno fix listedUBUNTU-CVE-2022-25837
Ubuntu:25.10linux-oracleno fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-oracle-6.17no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-oracle-6.8no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-raspino fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-raspino fix listedUBUNTU-CVE-2022-25837
Ubuntu:25.10linux-raspino fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-25837
Ubuntu:25.10linux-realtimeno fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-25837
Ubuntu:25.10linux-riscvno fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-riscv-6.17no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-riscv-6.8no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2022-25837
Ubuntu:24.04:LTSlinux-xilinxno fix listedUBUNTU-CVE-2022-25837
Ubuntu:22.04:LTSlinux-xilinx-zynqmpno fix listedUBUNTU-CVE-2022-25837

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-294 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

References