Race Condition Vulnerability in Linux Kernel - Impacting Debian Packages
Summary
CVE-2022-49479: In the Linux kernel, the following vulnerability has been resolved: mt76: fix tx status related use-after-free race on station removal There is a small race window where ongoing tx activity can lead to a skb getting adde... Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It is widely used in various distributions, including Debian. This vulnerability specifically affects the mt76 driver, which is responsible for managing wireless network interfaces. The vulnerability arises from a race condition during the removal of a station, potentially leading to memory management issues.
Vulnerability Detail
In the Linux kernel, a race condition exists in the mt76 driver where ongoing transmission activities can lead to a socket buffer (skb) being added to the status tracking IDR after it has already been cleaned up. This can result in the wireless client identifier (wcid) being improperly linked in the status poll list, leading to potential use-after-free scenarios. Such vulnerabilities can be exploited to cause system instability or unauthorized access to system resources.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workaround has been provided for this vulnerability. It is recommended to apply the patch as soon as it is available.
Conclusion
CVE-2022-49479 is a critical vulnerability in the Linux kernel's mt76 driver that can lead to serious system issues if not addressed. Users are strongly advised to update their systems to the patched version 5.18.5-1 to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49479 is a vulnerability in the Linux kernel's mt76 driver that can lead to a race condition and potential use-after-free issues.
This vulnerability can lead to system instability and may allow unauthorized access to system resources if exploited.
The vulnerability affects Linux versions prior to 5.18.5-1 in Debian 12 and Debian 13.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any installation.
Currently, there are no known workarounds. The best course of action is to update to the patched version as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
