{"id":"CVE-2022-2652","aliases":["DEBIAN-CVE-2022-2652","EUVD-2022-34898","GHSA-grx9-955g-vjfg","UBUNTU-CVE-2022-2652","openSUSE-SU-2022:10159-1","openSUSE-SU-2022:10160-1","openSUSE-SU-2024:12372-1"],"status":"published","title":"Use of Externally-Controlled Format String in umlaeute/v4l2loopback","description":"Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).","severity":{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00334,"percentile":0.26969,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-134"],"published":"2022-08-04T09:35:37Z","modified":"2026-10-28T10:27:44Z","fixes":[{"ecosystem":"Debian:12","package":"v4l2loopback","fixed_in":["0.12.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"v4l2loopback","fixed_in":["0.12.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"v4l2loopback","fixed_in":["0.12.7-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"v4l2loopback","fixed_in":["0.12.5-lp154.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"v4l2loopback","fixed_in":["0.12.5-lp153.2.5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"v4l2loopback","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"v4l2loopback","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"v4l2loopback","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.7-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"v4l2loopback","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.0-4ubuntu2","0.9.1-4","0.9.1-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"v4l2loopback","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0-1","0.10.0-1ubuntu1","0.10.0-1ubuntu1.1","0.10.0-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"v4l2loopback","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.2-1","0.12.3-1","0.12.3-1ubuntu0.1","0.12.3-1ubuntu0.2","0.12.3-1ubuntu0.3","0.12.3-1ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"v4l2loopback","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.5-1ubuntu3","0.12.5-1ubuntu4","0.12.5-1ubuntu5","0.12.7-2ubuntu2~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"v4l2loopback","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.7-2ubuntu4","0.12.7-2ubuntu5","0.12.7-2ubuntu5.1","0.12.7-2ubuntu5.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"v4l2loopback","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.2-1ubuntu1","0.15.0-0ubuntu1","0.15.0-0ubuntu2","0.15.0-0ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"v4l2loopback","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.15.3-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"v4l2loopback","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.15.0-0ubuntu2","0.15.3-1ubuntu1","0.15.3-1ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"v4l2loopback","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-lp154.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"v4l2loopback","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-lp153.2.5.1"}]}]}],"products":[{"vendor":"umlaeute","product":"umlaeute/v4l2loopback"},{"vendor":"v4l2loopback_project","product":"v4l2loopback"}],"references":[{"url":"https://huntr.dev/bounties/1b055da5-7a9e-4409-99d7-030280d242d5","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","web","report"]},{"url":"https://github.com/umlaeute/v4l2loopback/commit/e4cd225557486c420f6a34411f98c575effd43dd","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2652","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-grx9-955g-vjfg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2652.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-2652","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-2652","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2652","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/F2WY45Y5MOK5BLB5QRH5F6TM4CWLBTL5/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1202156","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2652","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/T7TOUD7WBZ7HIZPTAF5TWVMSY3TRYEZ7/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-2652","title":"Use of Externally-Controlled Format String in umlaeute/v4l2loopback","description":"Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).","status":"published","published":"2022-08-04T09:35:37Z","modified":"2024-08-03T00:46:03.489Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:34:32.156873Z"}],"euvd":[{"id":"EUVD-2022-34898","description":"Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).","status":"published","published":"2022-08-04T09:35:37Z","modified":"2024-08-03T00:46:03Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T03:25:57.932023Z"}],"ghsa":[{"id":"GHSA-grx9-955g-vjfg","title":"Depending on the way the format strings in the card label are crafted it's possible to leak...","description":"Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).","status":"published","published":"2022-08-05T00:00:30Z","modified":"2023-01-30T05:01:21Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H","level":"medium"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:46:23.547617Z"}],"nvd":[{"id":"CVE-2022-2652","description":"Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).","status":"published","published":"2022-08-04T10:15:07.99Z","modified":"2026-06-17T04:42:17.237Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:07:24.39467Z"}],"osv":[{"id":"CVE-2022-2652","title":"Use of Externally-Controlled Format String in umlaeute/v4l2loopback","description":"Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).","status":"published","published":"2022-08-04T09:35:37Z","modified":"2026-10-28T10:27:44.169535098Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"DEBIAN-CVE-2022-2652","description":"Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).","status":"published","published":"2022-08-04T10:15:07.99Z","modified":"2026-11-03T08:02:58.604388332Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"UBUNTU-CVE-2022-2652","description":"Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).","status":"published","published":"2022-08-04T10:15:00Z","modified":"2026-10-17T12:55:57.495420161Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L","level":"high"},{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"openSUSE-SU-2022:10159-1","title":"Security update for v4l2loopback","description":"This update for v4l2loopback fixes the following issues:\n\n- Fix string format vulnerability (boo#1202156, CVE-2022-2652)\n","status":"published","published":"2022-10-20T16:01:41Z","modified":"2026-02-04T03:17:45.329279Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:10160-1","title":"Security update for v4l2loopback","description":"This update for v4l2loopback fixes the following issues:\n\n- Fix string format vulnerability (boo#1202156, CVE-2022-2652)\n","status":"published","published":"2022-10-20T16:01:45Z","modified":"2026-02-04T04:08:57.979579Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12372-1","title":"v4l2loopback-autoload-0.12.7-1.1 on GA media","description":"These are all security issues fixed in the v4l2loopback-autoload-0.12.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:40:35.353779Z","updated_at":"2026-11-02T16:58:35.751245Z"}]}}