Use-after-free vulnerability in mt76 package
Summary
GSD-2022-1002922: mt76: fix use-after-free by removing a non-RCU wcid pointer. Affects Kernel versions < e55bcdd0bf34a8b10d45ce80ebb3164c5292a17d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mt76 package is a driver for MediaTek MT76x0e, MT76x2e, MT7603, MT7615, MT7628, and MT7688 Wi-Fi chips. It provides support for wireless network communication on Linux systems. The package is widely used in various devices, including routers, access points, and embedded systems.
Vulnerability Detail
The vulnerability in the mt76 package is a use-after-free issue caused by a non-RCU (Read-Copy Update) wcid (Wireless Client ID) pointer. This vulnerability could be exploited by an attacker to execute arbitrary code or cause a denial-of-service condition. The use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed, leading to unpredictable behavior and potential security risks. The vulnerability has been fixed in Linux Kernel version v5.17.14 by commit e55bcdd0bf34a8b10d45ce80ebb3164c5292a17d.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the fix by updating the Linux Kernel.
Conclusion
The use-after-free vulnerability in the mt76 package has been fixed in Linux Kernel version v5.17.14. It is recommended to update the Linux Kernel to the latest version to mitigate the vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could allow an attacker to execute arbitrary code or cause a denial-of-service condition on systems using the mt76 package.
There is no known exploit available for this vulnerability at the moment.
The vulnerability affects versions of the mt76 package prior to the fix in Linux Kernel version v5.17.14.
The recommended mitigation is to update the Linux Kernel to version v5.17.14 or later.
For more details about the vulnerability, you can refer to the source link provided in the database specific information section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
