CVE-2022-41674: Integer Overflow in cfg80211_update_notlisted_nontrans
Summary
CVE-2022-41674: In cfg80211_update_notlisted_nontrans of scan.c, there is a possible out of bounds write due to an integer overflow. Affects :linux_kernel: versions >= :0, < :2023-01-05. Fixed in :2023-01-05. How to fix ↓
Also tracked for
- linux-lts · Alpine:v3.15
The same CVE-2022-41674 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package under scrutiny is the Linux Kernel, which is a critical component of the Android ecosystem. It provides the core functionality and services for the operating system. The vulnerability affects the cfg80211_update_notlisted_nontrans function in the scan.c file. This function is responsible for updating the non-transmitted information of the wireless configuration. The vulnerability arises due to an integer overflow, which can lead to an out of bounds write. This vulnerability can be exploited remotely without requiring any additional execution privileges or user interaction.
Vulnerability Detail
The vulnerability in cfg80211_update_notlisted_nontrans is caused by an integer overflow. This overflow can result in an out of bounds write, potentially leading to remote code execution. The impact of this vulnerability is critical, as it can be exploited remotely without any user interaction. An attacker could exploit this vulnerability to execute arbitrary code on the affected system. The fix for this vulnerability has been implemented in the Linux Kernel, specifically in the cfg80211_update_notlisted_nontrans function.
How To Fix
Minimum fixed version
:2023-01-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix by updating the Linux Kernel to a version that includes the necessary patch.
Conclusion
The vulnerability in cfg80211_update_notlisted_nontrans of the Linux Kernel can lead to remote code execution without requiring any additional execution privileges or user interaction. To mitigate this risk, it is crucial to update the Linux Kernel to a version that includes the fix. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for :linux_kernel: →
FAQ
The impact of this vulnerability is critical, as it can lead to remote code execution without requiring any additional execution privileges or user interaction.
No, user interaction is not needed for exploitation of this vulnerability.
The affected package is the Linux Kernel, which is a critical component of the Android ecosystem.
To fix this vulnerability, it is recommended to update the Linux Kernel to a version that includes the fix.
There are no specific workarounds mentioned for this vulnerability. The recommended approach is to apply the fix by updating the Linux Kernel.
References
Related vulnerabilities
Recent vulnerabilities recorded for :linux_kernel:.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
