Fix deadlock in ieee80211_beacons_stop() in drivers: staging: rtl8192u
Summary
GSD-2022-1003826: drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop(). Affects Kernel versions < b465bb2ebf666116c1ac745cb80c65154dc0d27e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rtl8192u driver is a staging driver in the Linux Kernel that provides support for Realtek RTL8192U USB wireless network adapters. This driver is part of the staging area, which means it is still under development and may contain bugs and vulnerabilities. The ieee80211_beacons_stop() function is responsible for stopping the transmission of beacon frames, which are used by wireless access points to advertise their presence. A deadlock occurs in this function, leading to a system freeze or unresponsiveness.
Vulnerability Detail
The vulnerability in the drivers: staging: rtl8192u package arises from a deadlock in the ieee80211_beacons_stop() function. When this function is called, it can result in a deadlock situation where the system becomes unresponsive or freezes. This vulnerability can be exploited by an attacker within range of a vulnerable device to cause a denial-of-service (DoS) condition. The impact of this vulnerability is limited to systems that have the rtl8192u driver loaded and are using a wireless network adapter supported by this driver.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a possible workaround is to unload the rtl8192u driver module. This can be done by running the following command as root:
rmmod rtl8192u
However, this workaround will disable the functionality provided by the rtl8192u driver, which may impact the use of Realtek RTL8192U USB wireless network adapters.
Conclusion
The vulnerability in drivers: staging: rtl8192u, which causes a deadlock in the ieee80211_beacons_stop() function, can lead to system freeze or unresponsiveness. It is recommended to update the Linux Kernel to version v4.19.247 or later to fix this vulnerability. If immediate kernel update is not possible, unloading the rtl8192u driver module can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is limited to systems that have the rtl8192u driver loaded and are using a wireless network adapter supported by this driver. An attacker within range of a vulnerable device can exploit this vulnerability to cause a denial-of-service (DoS) condition, leading to system freeze or unresponsiveness.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software, without requiring access to the code or installation.
Yes, a patch for this vulnerability is available in the Linux Kernel version v4.19.247. It is recommended to update the kernel to this version or later to fix the vulnerability.
Yes, if updating the Linux Kernel is not immediately feasible, you can unload the rtl8192u driver module as a workaround. However, this will disable the functionality provided by the driver, which may impact the use of Realtek RTL8192U USB wireless network adapters.
You can find more information about this vulnerability in the GSD-2022-1003826 JSON report available at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1003xxx/GSD-2022-1003826.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
