CVE-2022-42895

MediumCVSS 6.5/10Last modified Oct 14, 2026

Description

There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely. We recommend upgrading past commit  https://github.com/torvalds/linux/commit/b1a2cd50c0357f243b7435a732b4e62ba3157a2e https://www.google.com/url

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-824

Affected software

VendorProductVersions
LinuxLinux Kernel>= 3.0.0, <= b1a2cd50c0357f243b7435a732b4e62ba3157a2e
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< V1.1

References

Timeline

Published
Nov 23, 2022
Last modified
Oct 14, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-428968.8There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functionsCVE-2022-428979.8Array Networks AG/vxAG with ArrayOS AG before 9.4.0.469 allows unauthenticated command injection that leads to privilege escalation and contCVE-2022-428988.8PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code executionCVE-2022-428997.8Bentley MicroStation and MicroStation-based applications may be affected by out-of-bounds read and stack overflow issues when opening crafteCVE-2022-42908.8The Cyr to Lat plugin for WordPress is vulnerable to authenticated SQL Injection via the 'ctl_sanitize_title' function in versions up to, anCVE-2022-429007.8Bentley MicroStation and MicroStation-based applications may be affected by out-of-bounds read issues when opening crafted FBX files. ExploiCVE-2022-429017.8Bentley MicroStation and MicroStation-based applications may be affected by out-of-bounds and stack overflow issues when opening crafted XMTCVE-2022-429028.8In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py. Due to improCVE-2022-429033.3Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list.CVE-2022-429047.2Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings.CVE-2022-429059.1In wolfSSL before 5.5.2, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS 1.3 client or network attaCVE-2022-429067.8powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository conf