Out-of-Bounds Vulnerability in rtw89 Package
Summary
GSD-2022-1002752: rtw89: cfo: check mac_id to avoid out-of-bounds. Affects Kernel versions < c32fafe68298bb599e825c298e1d0ba30186f0a5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The rtw89 package is a component of the Linux Kernel ecosystem. It provides functionality for wireless network adapters that use the Realtek RTL8822BE chipset. The package allows communication between the operating system and the wireless adapter, enabling wireless network connectivity. However, a vulnerability has been discovered in the package that could potentially lead to out-of-bounds memory access.
Vulnerability Detail
The vulnerability in the rtw89 package involves a lack of proper bounds checking when handling the mac_id parameter. This could allow an attacker to provide a malicious value for mac_id, leading to out-of-bounds memory access. The impact of this vulnerability is not yet fully determined, but it has the potential to result in arbitrary code execution or denial of service attacks. The vulnerability has been addressed in the Linux Kernel version v5.18.3 by commit c32fafe68298bb599e825c298e1d0ba30186f0a5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the affected wireless network adapter or disconnect it from the system to mitigate the risk of exploitation. However, this may result in the loss of wireless network connectivity.
Conclusion
The out-of-bounds vulnerability in the rtw89 package can potentially lead to serious security issues. It is crucial to update the Linux Kernel to version v5.18.3 or later and recompile/reinstall the rtw89 package to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The rtw89 package is a component of the Linux Kernel ecosystem that provides support for wireless network adapters using the Realtek RTL8822BE chipset.
The impact of this vulnerability is not yet fully determined, but it has the potential to result in arbitrary code execution or denial of service attacks.
Yes, this vulnerability has been fixed in the Linux Kernel version v5.18.3 by commit c32fafe68298bb599e825c298e1d0ba30186f0a5.
To fix this vulnerability, update the Linux Kernel to version v5.18.3 or later and recompile/reinstall the rtw89 package.
A workaround is to disable or disconnect the affected wireless network adapter, but this may result in the loss of wireless network connectivity.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
