CVE-2022-49416
Published: 26 February 2025
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix use-after-free in chanctx code In ieee80211_vif_use_reserved_context(), when we have an old context and the new context's replace_state is set to IEEE80211_CHANCTX_REPLACE_NONE, we free the old context in ieee80211_vif_use_reserved_reassign(). Therefore, we cannot check the old_ctx anymore, so we should set it to NULL after this point. However, since the new_ctx replace state is clearly not IEEE80211_CHANCTX_REPLACES_OTHER, we're not going to do anything else in this function and can just return to avoid accessing the freed old_ctx.
Security Summary
CVE-2022-49416 is a use-after-free vulnerability in the Linux kernel's mac80211 WiFi subsystem, specifically within the channel context (chanctx) code. The issue occurs in the ieee80211_vif_use_reserved_context() function, where an old context is freed via ieee80211_vif_use_reserved_reassign() when the new context's replace_state is IEEE80211_CHANCTX_REPLACE_NONE. After freeing, the code fails to nullify the old_ctx pointer, potentially leading to subsequent access of the freed memory if the function continues execution. This flaw is classified under CWE-416 and carries a CVSS v3.1 base score of 7.8.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity (AC:L) and no user interaction required (UI:N), as it requires only local access (AV:L) in an unscoped impact scenario (S:U). Successful exploitation could result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), potentially allowing arbitrary code execution, data corruption, or system crashes within the kernel context.
Mitigation involves applying the relevant upstream kernel patches from the provided stable commit references, including 265bec4779a38b65e86a25120370f200822dfa76, 2965c4cdf7ad9ce0796fac5e57debb9519ea721e, 4ba81e794f0fad6234f644c2da1ae14d5b95e1c4, 4f05a9e15edcdf5b97e0d86ab6ecd5f187289f6c, and 6118bbdf69f4718b02d26bbcf2e497eb66004331, which fix the use-after-free by properly nullifying the old_ctx pointer and early-returning to avoid further access.
Details
- CWE(s)