NetSight
IP …
medium5.5

CVE-2022-49942

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected When we are not co…

Impact

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected When we are not connected to a channel, sending channel "switch" announcement doesn't make any sense. The BSS list is empty in that case. This causes the for loop in cfg80211_get_bss() to be bypassed, so the function returns NULL (check line 1424 of net/wireless/scan.c), causing the WARN_ON() in ieee80211_ibss_csa_beacon() to get triggered (check line 500 of net/mac80211/ibss.c), which was consequently reported on the syzkaller dashboard. Thus, check if we have an existing connection before generating the CSA beacon in ieee80211_ibss_finish_csa().

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 3.13 before 4.9.328
from 4.10 before 4.14.293
from 4.15 before 4.19.258
from 4.20 before 5.4.213
from 5.5 before 5.10.142
from 5.11 before 5.15.66

Weakness classification

CWE-476

References