CVE-2022-1679: Use After Free
A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9khtcwaitfortarget function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Other sources
A vulnerability was found in ath9khtcprobedevice in drivers/net/wireless/ath/ath9k/htcdrvinit.c in the Linux kernel. In this flaw, a local user may gain access to kernel memory, leading to a system crash or a leak of internal kernel information. In more details. After ieee80211allochw executes finished, it saves variable priv into htchandle->drvpriv. Then, if function ath9khtcwaitfortarget executes failed, it directly frees variable hw by function ieee80211freehw, but it doesn't clear htchandle->drvpriv. At now, the usb communication channel has been established. Function ath9khifusbrxstream is used to process received messages. It calls macro RXSTATINC to count packets' number. And this macro uses htchandle->drvpriv which has been freed before.
Reference: https://lore.kernel.org/lkml/87ilqc7jv9.fsf@kernel.org/t/
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.rt7.274.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.6.1.el9_1 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.6.1.rt21.168.el9_1 - Upgrade
Upgrade
redhat/Linux kernelto a version that resolves this vulnerability.Fixed in 5.18 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.107-1Fixed in 7.1.12-1Fixed in 7.1.13-1 - Compensating control
Mitigation: prevent the kernel module "ath9k" from being loaded (e.g., blacklist the module so it cannot load automatically) to avoid triggering the use-after-free in ath9k_htc_wait_for_target/ath9k_htc_probe_device described in the advisory.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-1679?
CVE-2022-1679 has a medium severity rating allowing local users to crash the system or potentially escalate privileges.
How do I fix CVE-2022-1679?
To fix CVE-2022-1679, update your Linux kernel to the recommended versions, such as 0:4.18.0-477.10.1.rt7.274.el8_8 or newer for Red Hat.
Who is affected by CVE-2022-1679?
CVE-2022-1679 affects systems running the Linux kernel versions that are vulnerable, particularly those with Atheros wireless adapter drivers.
Can CVE-2022-1679 be exploited remotely?
CVE-2022-1679 cannot be exploited remotely as it requires local user access to trigger the vulnerability.
What impact does CVE-2022-1679 have on system security?
CVE-2022-1679 can lead to system crashes and privilege escalation, potentially compromising system integrity and confidentiality.