PT-2022-2920 · Google · Fuchsia

Published 2022-03-02 · Updated 2023-07-21 · CVE-2022-0882

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fuchsia versions prior to 4.1.1

Description The issue is related to information disclosure. An attacker can read the kernel log through exposed Zircon kernel addresses without the required capability ZX RSRC KIND ROOT.

Recommendations For versions prior to 4.1.1, upgrade the Fuchsia kernel to 4.1.1 or greater. As a temporary workaround, consider restricting access to the Zircon kernel addresses to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2022-03521

CVE-2022-0882

Affected Products

Fuchsia

References · 8

• 🔥 https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=94740 · Exploit
• https://osv.dev/vulnerability/CVE-2022-0882 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03521 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-0882 · Security Note
• https://t.me/cibsecurity/41829 · Telegram Post
• https://t.me/cvenotify/54883 · Telegram Post
• https://t.me/cvenotify/29646 · Telegram Post
• https://fuchsia.googlesource.com/fuchsia/+/5be4ba6410494c4c046502df70cf06474d6cfaba · Note