CVE-2022-1679: Use After Free
A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9khtcwaitfortarget function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Other sources
A vulnerability was found in ath9khtcprobedevice in drivers/net/wireless/ath/ath9k/htcdrvinit.c in the Linux kernel. In this flaw, a local user may gain access to kernel memory, leading to a system crash or a leak of internal kernel information. In more details. After ieee80211allochw executes finished, it saves variable priv into htchandle->drvpriv. Then, if function ath9khtcwaitfortarget executes failed, it directly frees variable hw by function ieee80211freehw, but it doesn't clear htchandle->drvpriv. At now, the usb communication channel has been established. Function ath9khifusbrxstream is used to process received messages. It calls macro RXSTATINC to count packets' number. And this macro uses htchandle->drvpriv which has been freed before.
Reference: https://lore.kernel.org/lkml/87ilqc7jv9.fsf@kernel.org/t/
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.rt7.274.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.6.1.el9_1 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.6.1.rt21.168.el9_1 - Upgrade
Upgrade
redhat/Linux kernelto a version that resolves this vulnerability.Fixed in 5.18 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.7-1Fixed in 7.1.8-1 - Compensating control
Prevent the affected kernel module from loading automatically by blacklisting the ath9k module (ath9k), as described in Red Hat solution 41278.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-1679?
CVE-2022-1679 has a medium severity rating allowing local users to crash the system or potentially escalate privileges.
How do I fix CVE-2022-1679?
To fix CVE-2022-1679, update your Linux kernel to the recommended versions, such as 0:4.18.0-477.10.1.rt7.274.el8_8 or newer for Red Hat.
Who is affected by CVE-2022-1679?
CVE-2022-1679 affects systems running the Linux kernel versions that are vulnerable, particularly those with Atheros wireless adapter drivers.
Can CVE-2022-1679 be exploited remotely?
CVE-2022-1679 cannot be exploited remotely as it requires local user access to trigger the vulnerability.
What impact does CVE-2022-1679 have on system security?
CVE-2022-1679 can lead to system crashes and privilege escalation, potentially compromising system integrity and confidentiality.