CVE-2022-49416

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49416
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix use-after-free in chanctx code In ieee80211_vif_use_reserved_context(), when we have an old context and the new context's replace_state is set to IEEE80211_CHANCTX_REPLACE_NONE, we free the old context in ieee80211_vif_use_reserved_reassign(). Therefore, we cannot check the old_ctx anymore, so we should set it to NULL after this point. However, since the new_ctx replace state is clearly not IEEE80211_CHANCTX_REPLACES_OTHER, we're not going to do anything else in this function and can just return to avoid accessing the freed old_ctx.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/265bec4779a38b65e86a25120370f200822dfa76 Patch
https://git.kernel.org/stable/c/2965c4cdf7ad9ce0796fac5e57debb9519ea721e Patch
https://git.kernel.org/stable/c/4ba81e794f0fad6234f644c2da1ae14d5b95e1c4 Patch
https://git.kernel.org/stable/c/4f05a9e15edcdf5b97e0d86ab6ecd5f187289f6c Patch
https://git.kernel.org/stable/c/6118bbdf69f4718b02d26bbcf2e497eb66004331 Patch
https://git.kernel.org/stable/c/82c8e7bbdd06c7ed58e22450cc5b37f33a25bb2c Patch
https://git.kernel.org/stable/c/88cc8f963febe192d6ded9df7217f92f380b449a Patch
https://git.kernel.org/stable/c/9f1e5cc85ad77e52f54049a94db0407445ae2a34 Patch
https://git.kernel.org/stable/c/b79110f2bf6022e60e590d2e094728a8eec3e79e Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

24 Mar 2025, 19:57

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/265bec4779a38b65e86a25120370f200822dfa76 - () https://git.kernel.org/stable/c/265bec4779a38b65e86a25120370f200822dfa76 - Patch
References () https://git.kernel.org/stable/c/2965c4cdf7ad9ce0796fac5e57debb9519ea721e - () https://git.kernel.org/stable/c/2965c4cdf7ad9ce0796fac5e57debb9519ea721e - Patch
References () https://git.kernel.org/stable/c/4ba81e794f0fad6234f644c2da1ae14d5b95e1c4 - () https://git.kernel.org/stable/c/4ba81e794f0fad6234f644c2da1ae14d5b95e1c4 - Patch
References () https://git.kernel.org/stable/c/4f05a9e15edcdf5b97e0d86ab6ecd5f187289f6c - () https://git.kernel.org/stable/c/4f05a9e15edcdf5b97e0d86ab6ecd5f187289f6c - Patch
References () https://git.kernel.org/stable/c/6118bbdf69f4718b02d26bbcf2e497eb66004331 - () https://git.kernel.org/stable/c/6118bbdf69f4718b02d26bbcf2e497eb66004331 - Patch
References () https://git.kernel.org/stable/c/82c8e7bbdd06c7ed58e22450cc5b37f33a25bb2c - () https://git.kernel.org/stable/c/82c8e7bbdd06c7ed58e22450cc5b37f33a25bb2c - Patch
References () https://git.kernel.org/stable/c/88cc8f963febe192d6ded9df7217f92f380b449a - () https://git.kernel.org/stable/c/88cc8f963febe192d6ded9df7217f92f380b449a - Patch
References () https://git.kernel.org/stable/c/9f1e5cc85ad77e52f54049a94db0407445ae2a34 - () https://git.kernel.org/stable/c/9f1e5cc85ad77e52f54049a94db0407445ae2a34 - Patch
References () https://git.kernel.org/stable/c/b79110f2bf6022e60e590d2e094728a8eec3e79e - () https://git.kernel.org/stable/c/b79110f2bf6022e60e590d2e094728a8eec3e79e - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mac80211: corrección de use-after-free en el código chanctx En ieee80211_vif_use_reserved_context(), cuando tenemos un contexto antiguo y el replace_state del nuevo contexto está configurado en IEEE80211_CHANCTX_REPLACE_NONE, liberamos el contexto antiguo en ieee80211_vif_use_reserved_reassign(). Por lo tanto, ya no podemos verificar el old_ctx, por lo que deberíamos configurarlo en NULL después de este punto. Sin embargo, dado que el estado de reemplazo de new_ctx claramente no es IEEE80211_CHANCTX_REPLACES_OTHER, no vamos a hacer nada más en esta función y podemos simplemente regresar para evitar acceder al old_ctx liberado.

27 Feb 2025, 19:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-416

26 Feb 2025, 07:01

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-26 07:01

Updated : 2025-03-24 19:57

NVD link : CVE-2022-49416

Mitre link : CVE-2022-49416

CVE.ORG link : CVE-2022-49416

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free