CVE-2022-49500: wl1251: dynamically allocate memory used for DMA
In the Linux kernel, the following vulnerability has been resolved:
wl1251: dynamically allocate memory used for DMA
With introduction of vmap'ed stacks, stack parameters can no longer be used for DMA and now leads to kernel panic.
It happens at several places for the wl1251 (e.g. when accessed through SDIO) making it unuseable on e.g. the OpenPandora.
We solve this by allocating temporary buffers or use wl1251read32().
Tested on v5.18-rc5 with OpenPandora.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel with the wl1251 wireless driver are affected when the driver performs DMA using stack-based parameters. The issue is specifically noted to occur in several wl1251 paths, including access through SDIO, and was observed on OpenPandora.
What is the practical impact if the vulnerable code is triggered?
Use of stack parameters for DMA after vmap'ed stacks are introduced can lead to a kernel panic. This can make the wl1251 driver unusable, affecting wireless functionality on impacted systems.
What does the fix change?
The fix replaces DMA use of stack-based parameters with dynamically allocated temporary buffers, or uses wl1251_read32() where appropriate. This prevents DMA from accessing memory that is no longer suitable for that purpose.