CVE-2022-42721: wifi: cfg80211: avoid nontransmitted BSS list corruption
Summary
CVE-2022-42721: In cfg80211_add_nontrans_list of scan.c, there is a possible way to corrupt a list due to a logic error in the code. Affects :linux_kernel: versions >= :0, < :2023-01-05. Fixed in :2023-01-05. How to fix ↓
Also tracked for
- linux-lts · Alpine:v3.15
The same CVE-2022-42721 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package under scrutiny is the Linux Kernel, specifically the wifi component. The wifi component is responsible for managing wireless network connections on devices. It provides functionality for scanning and connecting to wireless networks. The vulnerability affects the cfg80211 module within the wifi component.
Vulnerability Detail
The vulnerability, identified as CVE-2022-42721, resides in the cfg80211_add_nontrans_list function of the scan.c file. Due to a logic error in the code, it is possible to corrupt a list, leading to potential remote code execution. Exploitation of this vulnerability does not require any additional execution privileges or user interaction. The impact of successful exploitation could be severe, allowing an attacker to execute arbitrary code on the affected system.
How To Fix
Minimum fixed version
:2023-01-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the wifi component of the Linux Kernel is vulnerable to a logic error in the cfg80211 module, which could lead to remote code execution. It is crucial to update to a version of the Linux Kernel that includes the necessary fixes released on January 5, 2023. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for :linux_kernel: →
FAQ
The impact of this vulnerability is severe, as it allows for potential remote code execution on the affected system. An attacker could execute arbitrary code without requiring any additional execution privileges or user interaction.
No, user interaction is not needed for exploitation of this vulnerability.
The vulnerability affects the cfg80211 module within the wifi component of the Linux Kernel.
No, there are no known workarounds for this vulnerability. It is recommended to update to a version of the Linux Kernel that includes the necessary fixes.
More information about the fixes can be found in the provided sources:
- https://android.googlesource.com/kernel/common/+/9a8ef2030510a
- https://android.googlesource.com/kernel/common/+/0a861bd25dad5
- https://android.googlesource.com/kernel/common/+/9e99ca59ed397
- https://android.googlesource.com/kernel/common/+/bfe29873454f3
- https://android.googlesource.com/kernel/common/+/0a8ee682e4f99
- https://android.googlesource.com/kernel/common/+/fff244e9171b2
- https://android.googlesource.com/kernel/common/+/93a3a32554079
- https://android.googlesource.com/kernel/common/+/d15bb1f6dabe1
- https://android.googlesource.com/kernel/common/+/864f2d3482f4b
- https://android.googlesource.com/kernel/common/+/21df3a583e8e0
- https://android.googlesource.com/kernel/common/+/630060f117567
- https://android.googlesource.com/kernel/common/+/fee48f3bdd751
- https://android.googlesource.com/kernel/common/+/7d998f6b7365d
- https://android.googlesource.com/kernel/common/+/de124365a7d2d
References
Related vulnerabilities
Recent vulnerabilities recorded for :linux_kernel:.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
