214 lines
12 KiB
JSON
214 lines
12 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2022-49022",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2024-08-22T01:27:53.649Z",
|
||
"datePublished": "2024-10-21T20:06:29.239Z",
|
||
"dateUpdated": "2026-08-05T08:53:29.205Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T08:53:29.205Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac8021: fix possible oob access in ieee80211_get_rate_duration\n\nFix possible out-of-bound access in ieee80211_get_rate_duration routine\nas reported by the following UBSAN report:\n\nUBSAN: array-index-out-of-bounds in net/mac80211/airtime.c:455:47\nindex 15 is out of range for type 'u16 [12]'\nCPU: 2 PID: 217 Comm: kworker/u32:10 Not tainted 6.1.0-060100rc3-generic\nHardware name: Acer Aspire TC-281/Aspire TC-281, BIOS R01-A2 07/18/2017\nWorkqueue: mt76 mt76u_tx_status_data [mt76_usb]\nCall Trace:\n <TASK>\n show_stack+0x4e/0x61\n dump_stack_lvl+0x4a/0x6f\n dump_stack+0x10/0x18\n ubsan_epilogue+0x9/0x43\n __ubsan_handle_out_of_bounds.cold+0x42/0x47\nieee80211_get_rate_duration.constprop.0+0x22f/0x2a0 [mac80211]\n ? ieee80211_tx_status_ext+0x32e/0x640 [mac80211]\n ieee80211_calc_rx_airtime+0xda/0x120 [mac80211]\n ieee80211_calc_tx_airtime+0xb4/0x100 [mac80211]\n mt76x02_send_tx_status+0x266/0x480 [mt76x02_lib]\n mt76x02_tx_status_data+0x52/0x80 [mt76x02_lib]\n mt76u_tx_status_data+0x67/0xd0 [mt76_usb]\n process_one_work+0x225/0x400\n worker_thread+0x50/0x3e0\n ? process_one_work+0x400/0x400\n kthread+0xe9/0x110\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x22/0x30"
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
|
||
"baseScore": 8.1,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:A - The vulnerable airtime calculation runs in mac80211 on WiFi TX-status and RX paths (e.g. mt76_airtime_report for frames to the local MAC), so an attacker on the same wireless segment can reach it via WiFi traffic.\nAC:L - Drivers pass the hardware VHT MCS field (GENMASK(3,0), values 0–15) into rate_idx without clamping to MCS_GROUP_RATES; maintainers confirmed this occurs in real usage, so no attacker-uncontrollable race or rare config is required.\nPR:N - RX airtime accounting runs on frames addressed to the device MAC without authentication or local credentials; an unauthenticated adjacent WiFi peer can trigger the path.\nUI:N - No victim action is required beyond normal WiFi operation; the attacker only needs to exchange or inject frames on the wireless link.\nS:U - Impact is confined to the host kernel’s airtime accounting and memory access within the same security authority; there is no VM/IOMMU/sandbox boundary crossing.\nC:H - This is an out-of-bounds read of kernel memory past duration[MCS_GROUP_RATES]; per scoring guidance, OOB reads are C:H unless strictly limited to a few bytes, and rate_idx is a u8 on HE paths so the read is not tightly bounded on all call paths.\nI:N - The bug only reads a const duration table into a local airtime value; it does not write attacker-controlled data or provide a memory-corruption write/code-execution primitive.\nA:H - Out-of-bounds kernel reads can fault or oops when the index falls outside mapped rodata (especially for larger rate_idx values), and when crash potential is uncertain the higher availability impact is required."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"net/mac80211/airtime.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "db3e1c40cf2f973fbdd52ae0b59a9472b1c04f4a",
|
||
"lessThan": "0184ede0ec61b9cd075babfaa45081b1bf322234",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "db3e1c40cf2f973fbdd52ae0b59a9472b1c04f4a",
|
||
"lessThan": "59b54f0563b6546c94bdb6823d3b382c75407019",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "db3e1c40cf2f973fbdd52ae0b59a9472b1c04f4a",
|
||
"lessThan": "f0fcad4c7201ecfaa17357f4ce0c50b4708df22d",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "db3e1c40cf2f973fbdd52ae0b59a9472b1c04f4a",
|
||
"lessThan": "3e8f7abcc3473bc9603323803aeaed4ffcc3a2ab",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"net/mac80211/airtime.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "5.5",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "5.5",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.10.158",
|
||
"lessThanOrEqual": "5.10.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15.82",
|
||
"lessThanOrEqual": "5.15.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.0.12",
|
||
"lessThanOrEqual": "6.0.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.1",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.5",
|
||
"versionEndExcluding": "5.10.158"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.5",
|
||
"versionEndExcluding": "5.15.82"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.5",
|
||
"versionEndExcluding": "6.0.12"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.5",
|
||
"versionEndExcluding": "6.1"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/0184ede0ec61b9cd075babfaa45081b1bf322234"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/59b54f0563b6546c94bdb6823d3b382c75407019"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/f0fcad4c7201ecfaa17357f4ce0c50b4708df22d"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/3e8f7abcc3473bc9603323803aeaed4ffcc3a2ab"
|
||
}
|
||
],
|
||
"title": "wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"id": "CVE-2022-49022",
|
||
"role": "CISA Coordinator",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"version": "2.0.3",
|
||
"timestamp": "2024-10-22T13:12:26.001640Z"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2024-10-22T13:18:37.055Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |