Critical Vulnerability in Linux Kernel: Unregistered Network Device in wilc1000 Driver
Summary
CVE-2022-50361: In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: add missing unregister_netdev() in wilc_netdev_ifc_init() Fault injection test reports this issue: kernel BUG at net/core/dev.c:10731! Affects linux versions < 6.1.20-1. Fixed in 6.1.20-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. The wilc1000 driver is a part of the kernel that enables Wi-Fi connectivity for devices using the WILC1000 chipset. This driver is crucial for ensuring stable and efficient wireless communication. However, it has been found to contain a vulnerability that can lead to system instability and crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the wilc1000 driver related to the improper handling of network device registration. Specifically, if the function alloc_ordered_workqueue() fails during the initialization of the wilc_netdev_ifc_init() function, the necessary unregister_netdev() function is not called in the error handling path. This oversight can lead to a kernel panic, resulting in system crashes and potential data loss. The issue is highlighted by a kernel BUG report indicating an invalid opcode, which signifies a serious fault in the kernel's operation.
How To Fix
Minimum fixed version
6.1.20-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the Linux kernel to the fixed version.
Conclusion
The CVE-2022-50361 vulnerability in the Linux kernel's wilc1000 driver poses a significant risk of system crashes due to improper error handling. Users are strongly advised to update their systems to the latest patched version to ensure stability and security. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50361 is a vulnerability in the Linux kernel's wilc1000 driver that can cause kernel crashes due to improper error handling during network device initialization.
This vulnerability can lead to kernel panics, causing your system to crash unexpectedly, which may result in data loss and instability.
You can use Vulert, a tool that monitors open-source vulnerabilities, to check if your application is affected by this vulnerability. Simply upload your manifest file at Vulert Scanner.
Yes, a patch is available in version 6.1.20-1 or later of the Linux package for Debian 12, 13, and 14.
While there are no specific workarounds, it is crucial to prioritize updating your system to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
