CVE-2022-42720: Use After Free
A use-after-free flaw was found in bssrefget in the net/wireless/scan.c in the Linux kernel. This issue can lead to a denial of service or arbitrary code execution.
Other sources
There are multiple refcounting bugs related to multi-BSSID: - In bssrefget(), if the BSS has a hiddenbeaconbss, then the bss pointer is overwritten before checking for the transmitted BSS, which is clearly wrong. Fix this by using the bssfrompub() macro.
- In cfg80211bssupdate() we copy the transmittedbss pointer from tmp into new, but then if we release new, we'll unref it erroneously. We already set the pointer and ref it, but need to NULL it since it was copied from the tmp data.
- In cfg80211informsinglebssdata(), if adding to the non- transmitted list fails, we unlink the BSS and yet still we return it, but this results in returning an entry without a reference. We shouldn't return it anyway if it was broken enough to not get added there.
— Red Hat
Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-free conditions to potentially execute code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.rt7.274.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.el9_2 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.rt14.296.el9_2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-42720?
CVE-2022-42720 has been classified as a critical vulnerability due to its potential for denial of service and arbitrary code execution.
How do I fix CVE-2022-42720?
To address CVE-2022-42720, update to the latest kernel versions: 0:4.18.0-477.10.1.rt7.274.el8_8, 0:4.18.0-477.10.1.el8_8, 0:5.14.0-284.11.1.el9_2, or 0:5.14.0-284.11.1.rt14.296.el9_2 as appropriate.
What software versions are affected by CVE-2022-42720?
CVE-2022-42720 affects multiple software versions of the Linux kernel, including various Red Hat and Debian releases.
Which products are impacted by CVE-2022-42720?
CVE-2022-42720 impacts products such as Red Hat kernel, Red Hat kernel-rt, and Debian Linux distributions.
Can CVE-2022-42720 lead to data compromise?
Yes, CVE-2022-42720 can potentially lead to arbitrary code execution, which may result in data compromise.