Use-after-free race on station removal in mt76
Summary
GSD-2022-1002761: mt76: fix tx status related use-after-free race on station removal. Affects Kernel versions >= bd1e3e7b693c17a04e7d2bd9119daa482b7c7720, < ddd426d72aca4054045a9bd3b80a4ce1d398f11f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mt76 package is a driver for MediaTek MT76x0e, MT76x2e, MT7603, MT7615, MT7628, and MT7688 wireless chipsets. It provides support for Wi-Fi functionality on devices that use these chipsets. The package is a part of the Linux Kernel and is widely used in various Linux distributions. The vulnerability described in this report affects the mt76 package.
Vulnerability Detail
The vulnerability in mt76 is related to a use-after-free race condition that occurs when a station is removed. This race condition can lead to a situation where the tx status is accessed after the corresponding memory has been freed. An attacker may be able to exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition. The vulnerability was introduced in version v5.16 of the Linux Kernel and is fixed in version v5.18.3.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
The use-after-free race on station removal vulnerability in mt76 can be mitigated by updating the Linux Kernel to version v5.18.3 or later. Users are advised to apply the necessary updates or upgrade their Linux distribution to a version that includes the fixed kernel version. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
mt76 is a driver package for MediaTek wireless chipsets used in various Linux distributions.
A use-after-free race condition occurs when a program accesses memory that has been freed. This can lead to unpredictable behavior and potential security vulnerabilities.
This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial-of-service condition.
To fix this vulnerability, update the Linux Kernel to version v5.18.3 or later.
There is no known workaround for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
