Out-of-Bounds Memory Access in Linux Kernel - CVE-2022-49471
Summary
CVE-2022-49471: In the Linux kernel, the following vulnerability has been resolved: rtw89: cfo: check mac_id to avoid out-of-bounds Somehow, hardware reports incorrect mac_id and pollute memory. Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. The kernel is designed to be robust and secure, but vulnerabilities can arise due to complex interactions with hardware and software. CVE-2022-49471 specifically affects the rtw89 driver, which is used for Realtek wireless devices, highlighting a critical issue where incorrect hardware reports can lead to memory corruption.
Vulnerability Detail
CVE-2022-49471 is a vulnerability in the Linux kernel's rtw89 driver, where an incorrect mac_id reported by hardware can lead to out-of-bounds memory access. This issue arises when the driver attempts to access an array using an index that exceeds its bounds, potentially leading to memory corruption and unpredictable behavior. The specific error reported is an array-index-out-of-bounds, where an index of 188 is attempted on an array of size 64, indicating a serious flaw in input validation and error handling.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the rtw89 driver until the system is updated to a patched version. Additionally, monitoring hardware reports for anomalies may help mitigate the risk until a full update can be applied.
Conclusion
CVE-2022-49471 represents a significant vulnerability in the Linux kernel's rtw89 driver, which can lead to serious memory access issues. It is crucial for users to update their systems to the latest patched versions to ensure security and stability. Utilizing tools like Vulert can help in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49471 is a vulnerability in the Linux kernel's rtw89 driver that allows for out-of-bounds memory access due to incorrect hardware reporting.
This vulnerability can lead to memory corruption, which may cause system instability, crashes, or unauthorized access to sensitive data.
You should update your Linux kernel to version 5.18.5-1 or later to mitigate the risk associated with this vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities. You can check your application using the Vulert playground at Vulert Scanner without needing to sign up.
Failing to address this vulnerability could result in system crashes, data loss, or exploitation by malicious actors, leading to unauthorized access to your system.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
