PT-2022-1379 · Linux+9 · Linux Kernel+9
Sönke Huster
·
Published
2022-10-10
·
Updated
2024-06-15
·
CVE-2022-41674
CVSS v3.1
8.1
High
| Vector | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.19.16
Description
An issue in the Linux kernel allows attackers who can inject WLAN frames to cause a buffer overflow in the
ieee80211 bss info update function in net/mac80211/scan.c. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. The issue is also related to an integer overflow in the cfg80211 update notlisted nontrans function in net/wireless/scan.c, which could result in an out of bounds write.Recommendations
For Linux kernel versions prior to 5.19.16, update to version 5.19.16 or later to resolve the issue. As a temporary workaround, consider restricting access to WLAN frames to minimize the risk of exploitation. Additionally, disabling the
ieee80211 bss info update function or restricting the use of the cfg80211 update notlisted nontrans function in net/wireless/scan.c could help mitigate the risk until a patch is applied.Exploit
Fix
DoS
Memory Corruption
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu