CVE-2022-50665

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix failed to find the peer with peer_id 0 when disconnected

It has a fail log which is ath11k_dbg in ath11k_dp_rx_process_mon_status(),

as below, it will not print when debug_mask is not set ATH11K_DBG_DATA.

ath11k_dbg(ab, ATH11K_DBG_DATA,

"failed to find the peer with peer_id %d\n",

ppdu_info.peer_id);

When run scan with station disconnected, the peer_id is 0 for case

HAL_RX_MPDU_START in ath11k_hal_rx_parse_mon_status_tlv() which called

from ath11k_dp_rx_process_mon_status(), and the peer_id of ppdu_info is

reset to 0 in the while loop, so it does not match condition of the

check "if (ppdu_info->peer_id == HAL_INVALID_PEERID" in the loop, and

then the log "failed to find the peer with peer_id 0" print after the

check in the loop, it is below call stack when debug_mask is set

ATH11K_DBG_DATA.

The reason is this commit 01d2f285e3e5 ("ath11k: decode HE status tlv")

add "memset(ppdu_info, 0,

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References