CVE-2022-0882: Illegal access to Kernel log in Fuchsia

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-05-03 · updated 2026-06-17
Weakness: CWE-200

Description

A bug exists where an attacker can read the kernel log through exposed Zircon kernel addresses without the required capability ZX_RSRC_KIND_ROOT. It is recommended to upgrade the Fuchsia kernel to 4.1.1 or greater.

Affected products

Google LLC Fuchsia Kernel: before 4.1.1 — fixed in 4.1.1

How to fix

Upgrade to a fixed version: Google LLC Fuchsia Kernel 4.1.1. Check the vendor advisory for mitigations.

References

https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=94740
https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=94740

Get alerted when CVE-2022-0882 or the next vulnerability affects your stack