CVE-2022-50533: wifi: mac80211: mlme: fix null-ptr deref on failed assoc
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: mlme: fix null-ptr deref on failed assoc
If association to an AP without a link 0 fails, then we crash in tracing because it assumes that either apmldaddr or link 0 BSS is valid, since we clear sdata->vif.validlinks and then don't add the apmldaddr to the struct.
Since we clear also sdata->vif.cfg.apaddr, keep a local copy of it and assign it earlier, before clearing validlinks, to fix this.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which systems and conditions are affected?
Systems using the Linux kernel's mac80211 Wi-Fi stack are exposed when an association attempt to an AP without link 0 fails. The documented impact is a null-pointer dereference and crash, resulting in denial of service.
What access does an attacker need to trigger the issue?
An attacker would need local access and low privileges, according to the CVSS vector. Exploitation does not require user interaction, but it depends on causing or encountering a failed association with an AP that lacks link 0.
What is the recommended remediation?
Apply an available patch from the referenced stable Linux kernel commits. The provided information does not describe an alternative mitigation for systems that cannot be patched immediately.