Kernel Panic Vulnerability in Linux Package Due to DMA Memory Allocation Issue
Summary
CVE-2022-49500: In the Linux kernel, the following vulnerability has been resolved: wl1251: dynamically allocate memory used for DMA With introduction of vmap'ed stacks, stack parameters can no longer be used for DMA and now leads to ke... Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. It is widely used across various distributions, including Debian. The wl1251 driver, which is part of the Linux kernel, manages wireless communication for devices. This driver has been identified to have a vulnerability that affects its stability and functionality, particularly in devices like OpenPandora.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the wl1251 driver related to dynamic memory allocation for Direct Memory Access (DMA). With the introduction of vmap'ed stacks, stack parameters can no longer be utilized for DMA, leading to potential kernel panics. This issue arises in multiple scenarios, particularly when the wl1251 driver is accessed through SDIO, rendering it unusable on certain devices. The vulnerability has been resolved in version 5.18.5-1 of the Linux package.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can allocate temporary buffers or utilize the wl1251_read32() function to avoid the kernel panic issue until the package is updated.
Conclusion
The CVE-2022-49500 vulnerability in the Linux kernel's wl1251 driver poses a significant risk of kernel panics due to improper memory allocation for DMA. Users are advised to update to the patched version 5.18.5-1 to mitigate this issue. Temporary workarounds are available, but updating is the best long-term solution.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49500 is a vulnerability in the Linux kernel's wl1251 driver that can cause kernel panics due to improper memory allocation for DMA.
This vulnerability can lead to system instability and crashes, particularly on devices using the wl1251 driver for wireless communication.
If an immediate update is not possible, consider using the workaround of allocating temporary buffers or using the wl1251_read32() function to mitigate the issue.
While the vulnerability exists in the Linux kernel, its impact may vary depending on the distribution and version being used. It has been noted in Debian versions 12 and 13.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
