Vulnerability in mt76 SDIO Driver
Summary
GSD-2022-1001712: mt76: fix monitor mode crash with sdio driver. Affects Kernel versions < 13946d5a68efd11dd6af2f6ef4c908f6b00158a5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mt76 package is a driver for MediaTek MT76x0e, MT76x2e, MT7603, MT7615, and MT7663 wireless LAN chipsets. It provides support for Wi-Fi connectivity on Linux-based systems. The SDIO driver within mt76 is responsible for handling communication between the wireless chipset and the host system via the SDIO bus. This vulnerability affects the monitor mode functionality of the SDIO driver.
Vulnerability Detail
The vulnerability in the mt76 SDIO driver can lead to a crash when using monitor mode. Monitor mode is a feature that allows the wireless chipset to capture and analyze network traffic without associating with any specific network. The crash occurs due to a flaw in the driver's implementation, which can be triggered when attempting to enable monitor mode. An attacker within range of the affected device could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition or execute arbitrary code on the target system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the mt76 SDIO driver can lead to a crash when using monitor mode, potentially resulting in a denial-of-service (DoS) condition or arbitrary code execution. It is recommended to update the Linux Kernel to version v5.15.34 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a crash in the mt76 SDIO driver when using monitor mode. This crash can result in a denial-of-service (DoS) condition or potential execution of arbitrary code by an attacker.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
Yes, the vulnerability has been fixed in Linux Kernel version v5.15.34. Updating the Kernel to this version or later will apply the necessary patch.
No, this vulnerability requires an attacker to be within range of the affected device to exploit it.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
