Posting on the Linux Weekly News site, a subscriber with the moniker Johill said anyone who was scanning a network could be attacked using these flaws.
While one issue needed P2P functionality to be switched on, all five were a cause for concern for anyone who uses Wi-Fi.
The news was posted on LWN by editor Jonathan Corbet, himself a kernel developer, who wrote "anybody who uses Wi-Fi on untrusted networks should probably keep an eye out for the relevant updates". This was referred to as "tongue-in-cheek humour" by subscriber fmyhr, who wrote: "...anybody who uses WiFi on untrusted networks...' More tongue-in-cheek humour from our esteemed — albeit often grumpy — editor?"
|
|
SUSE's Marcus Meissner said in a mailing list post that patching the flaw had been delegated to Soenke and Intel's Johannes Berg.
In the course of their investigations, Soenke and Berg discovered four additional issues, three of the five could be used to effect remote code execution, while the other two could be used to cause a denial-of-service attack.
The CVEs issued are:
CVE-2022-41674: fix u8 overflow in cfg80211_update_notlisted_nontrans (max 256 byte overwrite) (RCE)
CVE-2022-42719: wifi: mac80211: fix MBSSID parsing use-after-free use after free condition (RCE)
CVE-2022-42720: wifi: cfg80211: fix BSS refcounting bugs ref counting use-after-free possibilities (RCE)
CVE-2022-42721: wifi: cfg80211: avoid nontransmitted BSS list corruption; list corruption, according to Berg, just make it an endless loop (DOS)
CVE-2022-42722: wifi: mac80211: fix crash in beacon protection for P2P-device NULL ptr dereference crash (DOS)
These vulnerabilities appear to have been in kernel since 2019, according to one poster, cesarb, who said on the Linux Weekly News website:
"Doing a quick look (the last commit in the series is https://git.kernel.org/pub/scm/linux/kernel/git/wireless/... and you can follow the 'parent' links for the rest), and looking at the Fixes: lines for them, it seems the commits being fixed are from the first quarter of 2019. So yeah, unfortunately old enough."
Soenke, who posted to the same list using the name eknoes, said most of these flaws were introduced in kernel versions 5.1 or 5.2. He provided proof-of-concept code for attacks on the Openwall site.
