CVE-2022-49942
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected When we are not connected to a channel, sending channel "switch" announcement doesn't make any sense. The BSS list is empty in that case. This causes the for loop in cfg80211_get_bss() to be bypassed, so the function returns NULL (check line 1424 of net/wireless/scan.c), causing the WARN_ON() in ieee80211_ibss_csa_beacon() to get triggered (check line 500 of net/mac80211/ibss.c), which was consequently reported on the syzkaller dashboard. Thus, check if we have an existing connection before generating the CSA beacon in ieee80211_ibss_finish_csa().
How to fix
- linux linux_kernel4.9.328, 4.14.293, 4.19.258, 5.4.213, 5.10.142, 5.15.66, 5.19.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 3.13 ≤ v < 4.9.328, 4.10 ≤ v < 4.14.293, 4.15 ≤ v < 4.19.258, 4.20 ≤ v < 5.4.213, 5.5 ≤ v < 5.10.142, 5.11 ≤ v < 5.15.66, 5.16 ≤ v < 5.19.8, 6.0 | 4.9.328, 4.14.293, 4.19.258, 5.4.213, 5.10.142, 5.15.66, 5.19.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.