PT-2022-6044 · Linux+4 · Linux Kernel+4

Ajay Kathat + 2 · Published 2022-11-24 · Updated 2023-12-06 · CVE-2022-47518

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.0.11

Description An issue in the Linux kernel's WILC1000 wireless driver is related to a heap-based buffer overflow. This occurs due to missing validation of the number of channels when copying the list of operating channels from Wi-Fi management frames. The exploitation of this issue can allow an attacker to execute arbitrary code or cause a denial of service.

Recommendations For Linux kernel versions prior to 6.0.11, update to version 6.0.11 or later to resolve the issue. As a temporary workaround, consider disabling the WILC1000 wireless driver until a patch is available. Restrict access to the cfg80211.c module in the WILC1000 driver to minimize the risk of exploitation. Avoid using the vulnerable function related to channel validation in the affected driver until the issue is resolved.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2022-3272

ALT-PU-2022-3273

ALT-PU-2022-3284

ALT-PU-2022-3285

ALT-PU-2022-3303

ALT-PU-2022-3310

ALT-PU-2022-3311

ALT-PU-2022-3364

ALT-PU-2022-3371

ALT-PU-2023-1044

ALT-PU-2023-1066

ALT-PU-2023-1378

ALT-PU-2023-4894

ALT-PU-2023-7007

ALT-PU-2023-7682

AZL-11856

BDU:2022-07508

CVE-2022-47518

DLA-3244-1

OESA-2022-2162

USN-5911-1

USN-5912-1

USN-5929-1

USN-5935-1

USN-5938-1

USN-5941-1

USN-5950-1

USN-5962-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Linux Kernel

Ubuntu

References · 75

• https://github.com/torvalds/linux/commit/0cdfa9e6f0915e3d243e2393bfa8a22e12d553b0 · Patch
• https://osv.dev/vulnerability/USN-5912-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47521 · Security Note
• https://ubuntu.com/security/CVE-2022-45869 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4378 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-47518 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3244-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5962-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-47518 · Security Note
• https://osv.dev/vulnerability/USN-5938-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-47518 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3643 · Security Note
• https://osv.dev/vulnerability/USN-5911-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3344 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0316SE47MD · Vendor Advisory