Log in Start free

Vulnerability · Published Oct 21, 2024 · Assigned by Linux

CVE-2022-48947Bluetooth: L2CAP: Fix u8 overflow

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.2%top 84.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix u8 overflow By keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases multiple times and eventually it will wrap around the maximum number (i.e., 255). This patch prevents this by adding a boundary check with L2CAP_MAX_CONF_RSP Btmon log: Bluetooth monitor ver 5.64 = Note: Linux version 6.1.0-rc2 (x86_64) 0.264594 = Note: Bluetooth subsystem version 2.22 0.264636 @ MGMT Open: btmon (privileged) version 1.22 {0x0001} 0.272191 = New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0) [hci0] 13.877604 @ RAW Open: 9496 (privileged) version 2.22 {0x0002} 13.890741 = Open Index: 00:00:00:00:00:00 [hci0] 13.900426 (...) > ACL Data RX: Handle 200 flags 0x00 dlen 1033 #32 [hci0] 14.273106 invalid packet size (12 != 1033) 08 00 01 00 02 01 04 00 01 10 ff ff ............ > ACL Data RX: Handle 200 flags 0x00 dlen 1547 #33 [hci0] 14.273561 invalid packet size (14 != 1547) 0a 00 01 00 04 01 06 00 40 00 00 00 00 00 ........@..... > ACL Data RX: Handle 200 flags 0x00 dlen 2061 #34 [hci0] 14.274390 invalid packet size (16 != 2061) 0c 00 01 00 04 01 08 00 40 00 00 00 00 00 00 04 ........@....... > ACL Data RX: Handle 200 flags 0x00 dlen 2061 #35 [hci0] 14.274932 invalid packet size (16 != 2061) 0c 00 01 00 04 01 08 00 40 00 00 00 07 00 03 00 ........@....... = bluetoothd: Bluetooth daemon 5.43 14.401828 > ACL Data RX: Handle 200 flags 0x00 dlen 1033 #36 [hci0] 14.275753 invalid packet size (12 != 1033) 08 00 01 00 04 01 04 00 40 00 00 00 ........@...

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.4-1DEBIAN-CVE-2022-48947
Debian:13linux6.1.4-1DEBIAN-CVE-2022-48947
Debian:14linux6.1.4-1DEBIAN-CVE-2022-48947
Rocky Linux:8kernel0:4.18.0-553.123.1.el8_10.cloud.0.1RXSA-2024:3138
Ubuntu:22.04:LTSlinux5.15.0-58.64UBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-aws5.15.0-1028.32UBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-azure5.15.0-1031.38UBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1031.38.1UBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-gcp5.15.0-1027.34UBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-gke5.15.0-1027.32UBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1013.17UBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-ibm5.15.0-1023.26UBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1023.28UBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-kvm5.15.0-1026.31UBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-58.64UBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1017.17UBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-oracle5.15.0-1027.33UBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-raspi5.15.0-1023.25UBUNTU-CVE-2022-48947
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-48947
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2022-48947

Affected products (as reported)

VendorProductVersions
Linux Linux f2fcfcd670257236ebf2088bbdf26f6a8ef459fe – before 49d5867819ab7c744852b45509e8469839c07e0ef2fcfcd670257236ebf2088bbdf26f6a8ef459fe – before 95f1847a361c7b4bf7d74c06ecb6968455082c1af2fcfcd670257236ebf2088bbdf26f6a8ef459fe – before ad528fde0702903208d0a79d88d5a42ae3fc235bf2fcfcd670257236ebf2088bbdf26f6a8ef459fe – before 9fdc79b571434af7bc742da40a3405f038b637a7f2fcfcd670257236ebf2088bbdf26f6a8ef459fe – before f3fe6817156a2ad4b06f01afab04638a34d7c9a6f2fcfcd670257236ebf2088bbdf26f6a8ef459fe – before 19a78143961a197de8502f4f29c453b913dc3c29f2fcfcd670257236ebf2088bbdf26f6a8ef459fe – before 5550bbf709c323194881737fd290c4bada9e6eadf2fcfcd670257236ebf2088bbdf26f6a8ef459fe – before bcd70260ef56e0aee8a4fc6cd214a419900b0765
Linux Linux 2.6.32

References