Critical Division by Zero Vulnerability in Linux Kernel's WiFi Driver (CVE-2022-50178)
Summary
CVE-2022-50178: In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: 8852a: rfk: fix div 0 exception The DPK is a kind of RF calibration whose algorithm is to fine tune parameters and calibrate, and check the... Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It supports a wide range of hardware and is known for its stability and performance. The vulnerability in question affects the WiFi driver, specifically the rtw89 module, which is responsible for handling wireless communication. This vulnerability can lead to a system crash due to a division by zero error during the RF calibration process.
Vulnerability Detail
The vulnerability arises from a flaw in the RF calibration algorithm used in the rtw89 WiFi driver. During the calibration process, the algorithm attempts to read and display calibration results, which may sometimes yield a negative value. This negative result can lead to a division by zero, causing a core dump and crashing the system. The issue was identified in the function rtw8852a_dpk, where the division operation does not check if the divisor is zero before performing the calculation. This oversight can lead to severe system instability and crashes, particularly affecting users relying on wireless connectivity.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the rtw89 WiFi driver until the system is updated to a patched version. This can be done by running the following command:
sudo modprobe -r rtw89_core
This command will remove the WiFi driver from the kernel, preventing the vulnerability from being exploited until an update is applied.
Conclusion
CVE-2022-50178 is a critical vulnerability in the Linux kernel's WiFi driver that can lead to system crashes due to a division by zero error. Users are strongly encouraged to update their kernel to the patched version 6.0.2-1 to ensure system stability and security. Temporary workarounds are available for those unable to update immediately.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50178 is a vulnerability in the Linux kernel's WiFi driver that can cause a system crash due to a division by zero error during RF calibration.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
Exploitation of this vulnerability can lead to system instability, crashes, and loss of wireless connectivity, affecting users' ability to connect to networks.
Yes, a patch is available in version 6.0.2-1 of the Linux kernel. Users are advised to update their systems to this version or later.
If you cannot update your kernel immediately, consider disabling the rtw89 WiFi driver as a temporary workaround to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
