CVE-2022-50248

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix double free on tx path. We see kernel crashes and lockups and KASAN errors related to ax210 firmware crashes. One of the KASAN dumps pointed at the tx path, and it appears there is indeed a way to double-free an skb. If iwl_mvm_tx_skb_sta returns non-zero, then the 'skb' sent into the method will be freed. But, in case where we build TSO skb buffer, the skb may also be freed in error case. So, return 0 in that particular error case and do cleanup manually. BUG: KASAN: use-after-free in __list_del_ent...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 08f7d8b69aaf137db8ee0a2d7c9e6cd6383ae250 < 0e1e311fd929c6a8dcfddcb4748c47b07e39821f, >= 08f7d8b69aaf137db8ee0a2d7c9e6cd6383ae250 < ae966649f665bc3868b935157dd4a3c31810dcc0, >= 08f7d8b69aaf137db8ee0a2d7c9e6cd6383ae250 < d8e32f1bf1a9183a6aad560c6688500222d24299, >= 08f7d8b69aaf137db8ee0a2d7c9e6cd6383ae250 < 8fabe41fba907e4fd826acbbdb42e09c681c515e, >= 08f7d8b69aaf137db8ee0a2d7c9e6cd6383ae250 < 3a2ecd1ec14075117ccb3e85f0fed224578ec228, >= 08f7d8b69aaf137db8ee0a2d7c9e6cd6383ae250 < 0473cbae2137b963bd0eaa74336131cb1d3bc6c3, >= 5.1, >= 5.1 < 5.4.229, >= 5.5 < 5.10.163, >= 5.11 < 5.15.86, >= 5.16 < 6.0.16, >= 6.1 < 6.1.2

Fixed versions

5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-415