CVE-2022-49479
Published: 26 February 2025
Description
In the Linux kernel, the following vulnerability has been resolved: mt76: fix tx status related use-after-free race on station removal There is a small race window where ongoing tx activity can lead to a skb getting added to the status tracking idr after that idr has already been cleaned up, which will keep the wcid linked in the status poll list. Fix this by only adding status skbs if the wcid pointer is still assigned in dev->wcid, which gets cleared early by mt76_sta_pre_rcu_remove
Security Summary
CVE-2022-49479 is a use-after-free vulnerability in the Linux kernel's mt76 driver, which handles MediaTek WiFi chipsets. The issue arises from a race condition during station removal, where ongoing transmit (tx) activity can add a socket buffer (skb) to the status tracking IDR after the IDR has been cleaned up. This leaves the wireless client ID (wcid) linked in the status poll list, potentially leading to memory corruption. The vulnerability is rated with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-416 (Use After Free).
A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of user interaction requirements. Successful exploitation could result in high impacts on confidentiality, integrity, and availability, such as arbitrary code execution or denial of service within the kernel context of the affected WiFi driver.
Mitigation involves applying the upstream kernel patches referenced in the stable repository commits. These fixes ensure that status skbs are only added to the tracking if the wcid pointer remains assigned in dev->wcid, which is cleared early by mt76_sta_pre_rcu_remove, closing the race window. Security practitioners should update affected Linux kernels to versions incorporating these commits: ddd426d72aca4054045a9bd3b80a4ce1d398f11f, ef7f9f894cfd0b2e471206409a529af4a26ddd55, and fcfe1b5e162bf473c1d47760962cec8523c00466.
Details
- CWE(s)