Lucene search

ZephyrCVE-2022-3806

HistoryJan 25, 2023 - 2:01 a.m.

CVE-2022-3806

2023-01-2502:01:19

CWE-415

zephyr

web.nvd.nist.gov

cve-2022-3806

bluetooth

hci

error handling

network buffer

security vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.003

Percentile

69.0%

JSON

Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer.

Affected configurations

Nvd

Node

zephyrprojectzephyrRange≤3.2.0

VendorProductVersionCPE
zephyrprojectzephyr*cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zephyrproject	zephyr	*	cpe:2.3:o:zephyrproject:zephyr::::::::

CNA Affected

[
  {
    "vendor": "zephyrproject-rtos",
    "product": "zephyr",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "v3.2",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w525-fm68-ppq3

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.003

Percentile

69.0%

JSON

Related for CVE-2022-3806