CVE-2022-42722: Null Pointer Dereference
A flaw was found in P2P-Device in wifi in ieee80211rxhdecrypt in net/mac80211/rx.c in the Linux kernel, leading to a denial of service.
Other sources
If beacon protection is active but the beacon cannot be decrypted or is otherwise malformed, we call the cfg80211 API to report this to userspace, but that uses a netdev pointer, which isn't present for P2P-Device.
— Red Hat
In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon protection of P2P devices.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.rt7.274.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.el9_2 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.rt14.296.el9_2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Compensating control
To mitigate the NULL pointer dereference DoS affecting beacon protection of P2P devices in Linux kernel 5.8 through 5.19.x before 5.19.16, prevent the kernel module mac80211 from being loaded (blacklist module mac80211 so it does not auto-load).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-42722?
CVE-2022-42722 has a severity rating that indicates it can lead to denial of service.
How do I fix CVE-2022-42722?
To fix CVE-2022-42722, upgrade to the recommended kernel versions specified in the vulnerability details.
Which Linux kernel versions are affected by CVE-2022-42722?
CVE-2022-42722 affects various Linux kernel versions including 4.18.x and 5.10.x up to 5.19.16, among others.
Is CVE-2022-42722 present in Fedora systems?
Yes, CVE-2022-42722 affects Fedora versions 35, 36, and 37.
What type of systems are impacted by CVE-2022-42722?
CVE-2022-42722 impacts systems running specific Linux kernel versions, including distributions like Red Hat and Debian.