CVE-2022-48787

In the Linux kernel, the following vulnerability has been resolved: iwlwifi: fix use-after-free If no firmware was present at all (or, presumably, all of the firmware files failed to parse), we end up unbinding by calling device_release_driver(), which calls remove(), which then in iwlwifi calls iwl_drv_stop(), freeing the 'drv' struct. However the new code I added will still erroneously access it after it was freed. Set 'failure=false' in this case to avoid the access, all data was already freed anyway.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/008508c16af0087cda0394e1ac6f0493b01b6063	Patch
https://git.kernel.org/stable/c/494de920d98f125b099f27a2d274850750aff957	Patch
https://git.kernel.org/stable/c/7d6475179b85a83186ccce59cdc359d4f07d0bcb	Patch
https://git.kernel.org/stable/c/9958b9cbb22145295ee1ffaea0904c383da2c05d	Patch
https://git.kernel.org/stable/c/bea2662e7818e15d7607d17d57912ac984275d94	Patch
https://git.kernel.org/stable/c/d3b98fe36f8a06ce654049540773256ab59cb53d	Patch
https://git.kernel.org/stable/c/ddd46059f7d99119b62d44c519df7a79f2e6a515	Patch
https://git.kernel.org/stable/c/008508c16af0087cda0394e1ac6f0493b01b6063	Patch
https://git.kernel.org/stable/c/494de920d98f125b099f27a2d274850750aff957	Patch
https://git.kernel.org/stable/c/7d6475179b85a83186ccce59cdc359d4f07d0bcb	Patch
https://git.kernel.org/stable/c/9958b9cbb22145295ee1ffaea0904c383da2c05d	Patch
https://git.kernel.org/stable/c/bea2662e7818e15d7607d17d57912ac984275d94	Patch
https://git.kernel.org/stable/c/d3b98fe36f8a06ce654049540773256ab59cb53d	Patch
https://git.kernel.org/stable/c/ddd46059f7d99119b62d44c519df7a79f2e6a515	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

21 Nov 2024, 07:34

Type	Values Removed	Values Added
References	~~() https://git.kernel.org/stable/c/008508c16af0087cda0394e1ac6f0493b01b6063 - Patch~~	() https://git.kernel.org/stable/c/008508c16af0087cda0394e1ac6f0493b01b6063 - Patch
References	~~() https://git.kernel.org/stable/c/494de920d98f125b099f27a2d274850750aff957 - Patch~~	() https://git.kernel.org/stable/c/494de920d98f125b099f27a2d274850750aff957 - Patch
References	~~() https://git.kernel.org/stable/c/7d6475179b85a83186ccce59cdc359d4f07d0bcb - Patch~~	() https://git.kernel.org/stable/c/7d6475179b85a83186ccce59cdc359d4f07d0bcb - Patch
References	~~() https://git.kernel.org/stable/c/9958b9cbb22145295ee1ffaea0904c383da2c05d - Patch~~	() https://git.kernel.org/stable/c/9958b9cbb22145295ee1ffaea0904c383da2c05d - Patch
References	~~() https://git.kernel.org/stable/c/bea2662e7818e15d7607d17d57912ac984275d94 - Patch~~	() https://git.kernel.org/stable/c/bea2662e7818e15d7607d17d57912ac984275d94 - Patch
References	~~() https://git.kernel.org/stable/c/d3b98fe36f8a06ce654049540773256ab59cb53d - Patch~~	() https://git.kernel.org/stable/c/d3b98fe36f8a06ce654049540773256ab59cb53d - Patch
References	~~() https://git.kernel.org/stable/c/ddd46059f7d99119b62d44c519df7a79f2e6a515 - Patch~~	() https://git.kernel.org/stable/c/ddd46059f7d99119b62d44c519df7a79f2e6a515 - Patch

07 Aug 2024, 19:48

Type	Values Removed	Values Added
References	~~() https://git.kernel.org/stable/c/008508c16af0087cda0394e1ac6f0493b01b6063 -~~	() https://git.kernel.org/stable/c/008508c16af0087cda0394e1ac6f0493b01b6063 - Patch
References	~~() https://git.kernel.org/stable/c/494de920d98f125b099f27a2d274850750aff957 -~~	() https://git.kernel.org/stable/c/494de920d98f125b099f27a2d274850750aff957 - Patch
References	~~() https://git.kernel.org/stable/c/7d6475179b85a83186ccce59cdc359d4f07d0bcb -~~	() https://git.kernel.org/stable/c/7d6475179b85a83186ccce59cdc359d4f07d0bcb - Patch
References	~~() https://git.kernel.org/stable/c/9958b9cbb22145295ee1ffaea0904c383da2c05d -~~	() https://git.kernel.org/stable/c/9958b9cbb22145295ee1ffaea0904c383da2c05d - Patch
References	~~() https://git.kernel.org/stable/c/bea2662e7818e15d7607d17d57912ac984275d94 -~~	() https://git.kernel.org/stable/c/bea2662e7818e15d7607d17d57912ac984275d94 - Patch
References	~~() https://git.kernel.org/stable/c/d3b98fe36f8a06ce654049540773256ab59cb53d -~~	() https://git.kernel.org/stable/c/d3b98fe36f8a06ce654049540773256ab59cb53d - Patch
References	~~() https://git.kernel.org/stable/c/ddd46059f7d99119b62d44c519df7a79f2e6a515 -~~	() https://git.kernel.org/stable/c/ddd46059f7d99119b62d44c519df7a79f2e6a515 - Patch
CPE		cpe:2.3:o:linux:linux_kernel::::::::
First Time		Linux Linux linux Kernel
CWE		CWE-416
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8
Summary		(es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: iwlwifi: corrige el use-after-free Si no había ningún firmware presente (o, presumiblemente, no se pudieron analizar todos los archivos de firmware), terminamos desvinculándolo llamando a device_release_driver( ), que llama a remove(), que luego en iwlwifi llama a iwl_drv_stop(), liberando la estructura 'drv'. Sin embargo, el nuevo código que agregué seguirá accediendo erróneamente a él después de que se haya liberado. Establezca 'failure=false' en este caso para evitar el acceso; todos los datos ya se liberaron de todos modos.

16 Jul 2024, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-07-16 12:15

Updated : 2024-11-21 07:34

NVD link : CVE-2022-48787

Mitre link : CVE-2022-48787

CVE.ORG link : CVE-2022-48787

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-416

Use After Free

7.8 /10