CVE-2022-50880

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()

When peer delete failed in a disconnect operation, use-after-free

detected by KFENCE in below log. It is because for each vdev_id and

address, it has only one struct ath10k_peer, it is allocated in

ath10k_peer_map_event(). When connected to an AP, it has more than

one HTT_T2H_MSG_TYPE_PEER_MAP reported from firmware, then the

array peer_map of struct ath10k will be set muti-elements to the

same ath10k_peer in ath10k_peer_map_event(). When peer delete failed

in ath10k_sta_state(), the ath10k_peer will be free for the 1st peer

id in array peer_map of struct ath10k, and then use-after-free happened

for the 2nd peer id because they map to the same ath10k_peer.

And clean up all peers in array peer_map for the ath10k_peer, then

user-after-free disappeared

peer map event log:

[ 306.911021] wlan0: authenticate with b0:2a:43:e6:75:0e

[ 306.957187] a

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References