A series of vulnerabilities has been identified in the wireless stack (mac80211) of the Linux kernel, some of which potentially allow for buffer overflow and remote code execution through the transmission of specially crafted packets by an access point. A fix is currently available only in the form of a patch.
Examples of frames causing the overflow have been published for demonstration of the attack possibility, along with a utility to inject these frames into the 802.11 wireless stack. The vulnerabilities are independent of the wireless drivers used. It is believed that the identified issues can be exploited to create working exploits for remote attacks on systems.
- CVE-2022-41674 — buffer overflow in the function cfg80211_update_notlisted_nontrans, allowing the overwriting of up to 256 bytes in the heap. The vulnerability manifests starting with Linux kernel 5.1 and can be used for remote code execution.
- CVE-2022-42719 — use-after-free access to a previously freed memory area in the MBSSID parsing code. The vulnerability manifests starting with Linux kernel 5.2 and can be used for remote code execution.
- CVE-2022-42720 — use-after-free access to a previously freed memory area in the reference counting code in BSS (Basic Service Set) mode. The vulnerability manifests starting with Linux kernel 5.1 and can be used for remote code execution.
- CVE-2022-42721 — corruption of the BSS list leading to infinite looping. The vulnerability manifests starting with Linux kernel 5.1 and can be used for denial of service.
- CVE-2022-42722 — dereferencing a null pointer in the beacon frame protection code. The issue can be used to effect a denial of service.
Source: opennet.ru
