CVE-2022-42896
High
Description
There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within proximity of the victim. We recommend upgrading past commit https://www.google.com/url https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4 https://www.google.com/url
SeverityHigh
CVSS8.0
Exploit probability—
Product
Linux Kernel
PublishedNov 23, 2022
First seenNov 23, 2022
Weakness typeCWE-416Use after free
How to fix
Update
- linux linux_kernel4.9.335, 4.14.301, 4.19.268, 5.4.226, 5.10.154, 5.15.78, 6.0.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | v < 4.9.335, 4.10 ≤ v < 4.14.301, 4.15 ≤ v < 4.19.268, 4.20 ≤ v < 5.4.226, 5.5 ≤ v < 5.10.154, 5.11 ≤ v < 5.15.78, 5.16 ≤ v < 6.0.8 | 4.9.335, 4.14.301, 4.19.268, 5.4.226, 5.10.154, 5.15.78, 6.0.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.