CVE-2022-49416: wifi: mac80211: fix use-after-free in chanctx code
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: fix use-after-free in chanctx code
In ieee80211vifusereservedcontext(), when we have an old context and the new context's replacestate is set to IEEE80211CHANCTXREPLACENONE, we free the old context in ieee80211vifusereservedreassign(). Therefore, we cannot check the oldctx anymore, so we should set it to NULL after this point.
However, since the newctx replace state is clearly not IEEE80211CHANCTXREPLACESOTHER, we're not going to do anything else in this function and can just return to avoid accessing the freed oldctx.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Avoid accessing the freed old context after reassigning/reserving chanctx contexts in mac80211: ensure old_ctx is not accessed after the point described as “NULL after this point”, by using the safer return flow described for ieee80211_vif_use_reserved_context() / ieee80211_vif_use_reserved_reassign().
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49416?
CVE-2022-49416 is classified as a high-severity vulnerability due to the potential for a use-after-free condition in the Linux kernel's wifi subsystem.
How do I fix CVE-2022-49416?
To fix CVE-2022-49416, update your Linux kernel to a version that addresses the vulnerability as specified in the security advisories.
Which versions of the Linux kernel are affected by CVE-2022-49416?
CVE-2022-49416 affects multiple versions, including those from 3.17 to 5.18.3, based on the introduced changes in the kernel.
What are the potential impacts of CVE-2022-49416 on my system?
The impact of CVE-2022-49416 could lead to system crashes or arbitrary code execution due to the use-after-free vulnerability.
Is there a workaround for CVE-2022-49416?
There are currently no known workarounds for CVE-2022-49416, and patching the kernel is the recommended solution.