Vulnerability in ath9k_htc Package: Potential Out of Bounds Access
Summary
GSD-2022-1003429: ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix. Affects Kernel versions >= 4ed1a8d4a25711f780b96920fff2bb531229e322, < 7f6defe0fabc79f29603c6fa3c80e4fe0456a3e9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ath9k_htc package is a wireless driver for Atheros IEEE 802.11n devices. It is a part of the Linux Kernel ecosystem and is responsible for managing wireless communication on compatible devices. The package provides functionality for transmitting and receiving data over Wi-Fi connections. However, a vulnerability has been discovered in the package that could lead to potential out of bounds access.
Vulnerability Detail
The vulnerability in the ath9k_htc package involves a potential out of bounds access with an invalid rxstatus->rs_keyix. This vulnerability could allow an attacker to access memory beyond the bounds of the allocated buffer, potentially leading to information disclosure or arbitrary code execution. The issue was introduced in version v3.15 of the Linux Kernel and has been fixed in version v5.15.46 by commit 7f6defe0fabc79f29603c6fa3c80e4fe0456a3e9.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is recommended to apply the fix mentioned above.
Conclusion
In conclusion, the ath9k_htc package in the Linux Kernel is vulnerable to a potential out of bounds access issue. This vulnerability could allow an attacker to access sensitive information or execute arbitrary code. It is crucial to update the Linux Kernel to version v5.15.46 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could potentially allow an attacker to access sensitive information or execute arbitrary code on affected systems.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the tool will analyze it for any known vulnerabilities.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely if the affected system is connected to a network.
The only effective mitigation for this vulnerability is to apply the fix mentioned above by updating the Linux Kernel.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
