CVE-2022-49754
Published: 27 March 2025
Summary
CVE-2022-49754 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 31.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2022-49754 is a buffer overflow vulnerability in the Linux kernel's Bluetooth subsystem, specifically in the mgmt_mesh_add() function within net/bluetooth/mgmt_util.c. The issue occurs because the destination buffer 'mesh_tx->param', an array of 48 bytes defined as u8 param[sizeof(struct mgmt_cp_mesh_send) + 29], receives data via memcpy that can be up to 50 bytes long. This stems from the caller mesh_send rejecting inputs only when len exceeds MGMT_MESH_SEND_SIZE + 31 (19 + 31 = 50), allowing overflows of 2 bytes. The vulnerability is classified under CWE-120 with a CVSS score of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation enables high-impact consequences, including unauthorized access to sensitive data, modification of system integrity, and denial of service through availability disruption, potentially leading to arbitrary code execution or kernel compromise.
Kernel patches addressing this issue are available in the following stable commits: https://git.kernel.org/stable/c/2185e0fdbb2137f22a9dd9fcbf6481400d56299b and https://git.kernel.org/stable/c/ed818fd8c531abf561b379995ee7cc4c68029464. Security practitioners should ensure affected Linux kernel versions are updated to incorporate these fixes.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-55169
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix a buffer overflow in mgmt_mesh_add() Smatch Warning: net/bluetooth/mgmt_util.c:375 mgmt_mesh_add() error: __memcpy() 'mesh_tx->param' too small (48 vs 50) Analysis: 'mesh_tx->param' is array of size 48. This is the destination.…
more
u8 param[sizeof(struct mgmt_cp_mesh_send) + 29]; // 19 + 29 = 48. But in the caller 'mesh_send' we reject only when len > 50. len > (MGMT_MESH_SEND_SIZE + 31) // 19 + 31 = 50.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel buffer overflow in Bluetooth mgmt subsystem allows low-privileged attacker to achieve arbitrary code execution or kernel compromise, directly enabling exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the buffer overflow in mgmt_mesh_add() by identifying, reporting, and applying kernel patches that fix the size mismatch between the 48-byte param buffer and up to 50-byte inputs.
Requires validation of input lengths at kernel entry points like the Bluetooth mgmt interface to ensure they do not exceed the allocated 48-byte mesh_tx->param buffer, preventing the memcpy overflow.
Implements kernel memory protections such as stack canaries, ASLR, and DEP to prevent or detect exploitation of the buffer overflow for arbitrary code execution or data corruption.