Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2022-45934
CVE-2022-45934:
Linux Kernel vulnerability analysis and mitigation
Overview
An integer overflow vulnerability (CVE-2022-45934) was discovered in the Linux kernel through version 6.0.10. The vulnerability specifically affects the l2capconfigreq function in net/bluetooth/l2capcore.c, which is susceptible to an integer wraparound vulnerability when processing L2CAPCONF_REQ packets. This vulnerability was discovered and disclosed in November 2022 (NVD, CVE).
Technical details
The vulnerability exists in the Bluetooth subsystem of the Linux kernel, specifically in the L2CAP (Logical Link Control and Adaptation Protocol) implementation. The issue occurs when the chan->numconfrsp counter increases multiple times due to repeated L2CAPCONFREQ packets, eventually causing an integer wraparound at the maximum value of 255. This was addressed by adding a boundary check with L2CAPMAXCONF_RSP (Kernel Patch). The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).
Impact
When successfully exploited, this vulnerability could allow a physically proximate attacker to cause a denial of service (system crash) through specially crafted L2CAPCONFREQ packets (NetApp Advisory, Debian Advisory).
Mitigation and workarounds
Multiple Linux distributions have released patches to address this vulnerability. Debian has fixed the issue in version 5.10.162-1 for the stable distribution (bullseye). Fedora 37 has addressed it in kernel version 6.0.15-300.fc37. Ubuntu has also released fixes across multiple kernel versions for different releases (Debian Advisory, Fedora Update).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management