CVE-2022-49533

CVE-2022-49533

High · published February 26, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
20.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ath11k: Change max no of active probe SSID and BSSID to fw capability

The maximum number of SSIDs in a for active probe requests is currently

reported as 16 (WLAN_SCAN_PARAMS_MAX_SSID) when registering the driver.

The scan_req_params structure only has the capacity to hold 10 SSIDs.

This leads to a buffer overflow which can be triggered from

wpa_supplicant in userspace. When copying the SSIDs into the

scan_req_params structure in the ath11k_mac_op_hw_scan route, it can

overwrite the extraie pointer.

Firmware supports 16 ssid * 4 bssid, for each ssid 4 bssid combo probe

request will be sent, so totally 64 probe requests supported. So

set both max ssid and bssid to 16 and 4 respectively. Remove the

redundant macros of ssid and bssid.

Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01300-QCAHKSWPL_SILICONZ-1

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00295 · 20.9th percentile
Published
2025-02-26T12:01Z
Affected products (2)
ProductVersionsFixed in
linux/linux_kernel≥ 5.6, < 5.17.145.17.14
linux/linux_kernel≥ 5.18, < 5.18.35.18.3
References (3)
EPSS history
Timeline
  • 26 FEB 02:13Z
    ath11k: Change max no of active probe SSID and BSSID to fw capability
    cvelistv5