CVE-2022-42719CWE-416

CVE-2022-42719

High · published October 14, 2022

CVSS v3.1
8.8
EPSS
1%
Percentile
71.4
In the wild
Unconfirmed
What it is

A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and potentially execute code.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01353 · 71.4th percentile
Weakness
CWE-416 · Use After Free
Published
2022-10-14T03:15Z
Affected products (10)
ProductVersionsFixed in
linux/linux_kernel≥ 5.2, < 5.4.2195.4.219
linux/linux_kernel≥ 5.5, < 5.10.1495.10.149
linux/linux_kernel≥ 5.11, < 5.15.745.15.74
linux/linux_kernel≥ 5.16, < 5.19.165.19.16
linux/linux_kernel≥ 6.0, < 6.0.26.0.2
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
References (23)
http://packetstormsecurity.com/files/171005/Kernel-Live-Patch-Security-Notice-LNS-0091-1.html · [email protected]http://www.openwall.com/lists/oss-security/2022/10/13/2 · [email protected]http://www.openwall.com/lists/oss-security/2022/10/13/5 · [email protected]https://bugzilla.suse.com/show_bug.cgi?id=1204051 · [email protected]https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git/commit/?id=ff05d4b45dd89b922578dac497dcabf57cf771c6 · [email protected]https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGHENNMLCWIQV2LLA56BJNFIUZ7WB4IY/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S2KTU5LFZNQS7YNGE56MT46VHMXL3DD2/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VNN3VFQPECS6D4PS6ZWD7AFXTOSJDSSR/ · [email protected]https://security.netapp.com/advisory/ntap-20230203-0008/ · [email protected]https://www.debian.org/security/2022/dsa-5257 · [email protected]http://packetstormsecurity.com/files/171005/Kernel-Live-Patch-Security-Notice-LNS-0091-1.html · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2022/10/13/2 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2022/10/13/5 · af854a3a-2127-422b-91ae-364da2661108https://bugzilla.suse.com/show_bug.cgi?id=1204051 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git/commit/?id=ff05d4b45dd89b922578dac497dcabf57cf771c6 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGHENNMLCWIQV2LLA56BJNFIUZ7WB4IY/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S2KTU5LFZNQS7YNGE56MT46VHMXL3DD2/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VNN3VFQPECS6D4PS6ZWD7AFXTOSJDSSR/ · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20230203-0008/ · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2022/dsa-5257 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-794697.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 13 OCT 00:00Z
    A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers…
    cvelistv5