CVE-2022-42722: Null Pointer Dereference
A flaw was found in P2P-Device in wifi in ieee80211rxhdecrypt in net/mac80211/rx.c in the Linux kernel, leading to a denial of service.
Other sources
If beacon protection is active but the beacon cannot be decrypted or is otherwise malformed, we call the cfg80211 API to report this to userspace, but that uses a netdev pointer, which isn't present for P2P-Device.
— Red Hat
In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon protection of P2P devices.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.rt7.274.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.el9_2 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.rt14.296.el9_2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.0.2-1 - Upgrade
Upgrade
alpine/linux-ltsto a version that resolves this vulnerability.Fixed in 5.15.74-r0 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 5.19.16 - Configuration
Blacklist the mac80211 kernel module to prevent it from being loaded automatically.
mac80211 module loading = disabled
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-42722?
CVE-2022-42722 has a severity rating that indicates it can lead to denial of service.
How do I fix CVE-2022-42722?
To fix CVE-2022-42722, upgrade to the recommended kernel versions specified in the vulnerability details.
Which Linux kernel versions are affected by CVE-2022-42722?
CVE-2022-42722 affects various Linux kernel versions including 4.18.x and 5.10.x up to 5.19.16, among others.
Is CVE-2022-42722 present in Fedora systems?
Yes, CVE-2022-42722 affects Fedora versions 35, 36, and 37.
What type of systems are impacted by CVE-2022-42722?
CVE-2022-42722 impacts systems running specific Linux kernel versions, including distributions like Red Hat and Debian.