CVE-2022-42721: Input Validation
A list corruption flaw was found in cfg80211addnontranslist in the net/wireless/scan.c function in the Linux kernel. This flaw could lead to a denial of service.
Other sources
A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in turn, potentially execute code.
If a non-transmitted BSS shares enough information (both SSID and BSSID!) with another non-transmitted BSS of a different AP, then we can find and update it, and then try to add it to the non-transmitted BSS list. We do a search for it on the transmitted BSS, but if it's not there (but belongs to another transmitted BSS), the list gets corrupted.
Refer: https://www.openwall.com/lists/oss-security/2022/10/13/2
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.rt7.274.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.el9_2 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.rt14.296.el9_2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-42721?
CVE-2022-42721 is classified as a denial of service vulnerability in the Linux kernel.
How do I fix CVE-2022-42721?
To mitigate CVE-2022-42721, update to kernel version 5.19.16 or later, or apply the relevant patches provided by your distribution.
Which systems are affected by CVE-2022-42721?
CVE-2022-42721 affects Linux kernel versions from 5.1 to 5.19.x prior to 5.19.16, as well as specific versions of Red Hat, Fedora, and Debian distributions.
What is the impact of CVE-2022-42721?
The impact of CVE-2022-42721 includes potential denial of service due to a list corruption flaw in the kernel.
Is CVE-2022-42721 exploitable remotely?
CVE-2022-42721 can potentially be exploited by local users to cause a denial of service.