Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).
CVSS Details
- CVSS 3.1 Base Score: 6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H)
- CVSS 3.0 Base Score: 7.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade v4l2loopback | Jul 30, 2024 | Aug 4, 2022 |
| Suse | — | Upgrade v4l2loopback-kmp-preemptUpgrade v4l2loopback-utilsUpgrade v4l2loopback-kmp-64kbUpgrade v4l2loopback-kmp-defaultUpgrade v4l2loopback-autoload | Oct 26, 2022 | Aug 4, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub
