CVE-2022-42719: Use After Free
A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and potentially execute code.
Other sources
In ieee80211parseelemscrc of util.c, there is a possible use after free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.0.2-1 - Upgrade
Upgrade
alpine/linux-ltsto a version that resolves this vulnerability.Fixed in 5.15.74-r0 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
android/:linux_kernel:to a version that resolves this vulnerability.Fixed in :2023-01-05
Event History
Frequently Asked Questions
What is the severity of CVE-2022-42719?
CVE-2022-42719 has a high severity due to its potential for allowing kernel crashes and code execution through a use-after-free vulnerability.
How do I fix CVE-2022-42719?
To fix CVE-2022-42719, you should update your Linux kernel to version 5.19.16 or later.
Which Linux kernel versions are affected by CVE-2022-42719?
CVE-2022-42719 affects Linux kernel versions from 5.2 up to 5.19.x before 5.19.16.
What are the possible impacts of exploiting CVE-2022-42719?
Exploiting CVE-2022-42719 could lead to a kernel crash and may allow attackers to execute arbitrary code.
Which distributions are impacted by CVE-2022-42719?
CVE-2022-42719 impacts several distributions including Google Android and various Debian and Fedora releases.