Lucene search

K
redhatcveRedhat.comRH:CVE-2022-20369
HistoryOct 25, 2022 - 10:20 a.m.

CVE-2022-20369

2022-10-2510:20:14
redhat.com
access.redhat.com
25
linux kernel
uvc camera
driver
input validation
privilege escalation
flaw
mmap

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0

Percentile

5.1%

An out-of-bounds write flaw was found in the Linux kernel’s UVC camera and similar device driver code due to improper input validation in the v4l2-mem2mem.c source code in how a user calls ioctl VIDIOC_QUERYBUF with mmap. This issue occurs if the capture buffer mapped directly from the userspace uses values from DQBUF, which returns an error. This flaw allows a local user to crash or escalate their privileges on the system.

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0

Percentile

5.1%