Vulnerability · Published Aug 4, 2022 · Assigned by @huntrdev
CVE-2022-2652Use of Externally-Controlled Format String in umlaeute/v4l2loopback
High 7.3
In plain English
A high-severity security flaw in umlaeute/v4l2loopback from umlaeute. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.0)7.3High
Exploit odds (30 days)0.3%top 73.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | v4l2loopback | 0.12.7-1 | DEBIAN-CVE-2022-2652 |
| Debian:13 | v4l2loopback | 0.12.7-1 | DEBIAN-CVE-2022-2652 |
| Debian:14 | v4l2loopback | 0.12.7-1 | DEBIAN-CVE-2022-2652 |
| Ubuntu:22.04:LTS | v4l2loopback | no fix listed | UBUNTU-CVE-2022-2652 |
| Ubuntu:24.04:LTS | v4l2loopback | no fix listed | UBUNTU-CVE-2022-2652 |
| Ubuntu:25.10 | v4l2loopback | no fix listed | UBUNTU-CVE-2022-2652 |
| Ubuntu:26.04:LTS | v4l2loopback | no fix listed | UBUNTU-CVE-2022-2652 |
| Ubuntu:26.10 | v4l2loopback | no fix listed | UBUNTU-CVE-2022-2652 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| umlaeute | umlaeute/v4l2loopback | unspecified – before 0.12.6 |
Weakness: CWE-134 · Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L