{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-49231", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-02-26T01:49:39.293Z", "datePublished": "2025-02-26T01:55:58.139Z", "dateUpdated": "2026-08-05T08:54:25.244Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:54:25.244Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtw88: fix memory overrun and memory leak during hw_scan\n\nPreviously we allocated less memory than actual required, overwrite\nto the buffer causes the mm module to complaint and raise access\nviolation faults. Along with potential memory leaks when returned\nearly. Fix these by passing the correct size and proper deinit flow." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is in rtw88 local hw_scan setup (rtw_ops_hw_scan → rtw_hw_scan_update_probe_req), reached only via nl80211 TRIGGER_SCAN / mac80211 hw_scan—not by processing Wi‑Fi frames from the air.\nAC:L - On a dual-band rtw88 device with scan-offload firmware, an attacker who can issue a scan with ≥1 SSID reliably drives num_ssids×bands probes into an undersized heap buffer; no race or external layout precondition is required.\nPR:L - NL80211_CMD_TRIGGER_SCAN uses GENL_UNS_ADMIN_PERM (CAP_NET_ADMIN in the wiphy netns user_ns). mac80211 sets WIPHY_FLAG_NETNS_OK, so when the WLAN device is in a user/net namespace that capability is available without real init-namespace root.\nUI:N - The attacker triggers the scan themselves through nl80211; no separate victim action (mount, open, click) is required.\nS:U - Impact is heap corruption and potential privilege escalation within the host kernel’s security authority, not a VM escape, IOMMU bypass, or other cross-boundary break.\nC:H - The undersized kzalloc followed by memcpy of multiple probe skbs is a heap out-of-bounds write that can be leveraged for adjacent-object disclosure primitives; guidance treats such memory corruption as Confidentiality High.\nI:H - Probe request contents (SSIDs/IEs) are attacker-influenced and are memcpy’d past the allocated buffer (up to ~2KB with 4 SSIDs×2 bands), yielding a heap OOB write usable for corruption and control-flow hijacking.\nA:H - The commit reports mm access-violation faults from the overrun, and heap corruption can oops/panic the kernel, so availability impact is High." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/realtek/rtw88/fw.c" ], "versions": [ { "version": "10d162b2ed395e69720926b4f8d87f1f25ca920f", "lessThan": "ec5da191bfcd5fd22b95459b623694f66c1cc10b", "status": "affected", "versionType": "git" }, { "version": "10d162b2ed395e69720926b4f8d87f1f25ca920f", "lessThan": "d95984b5580dcb8b1c0036577c52b609990a1dab", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/realtek/rtw88/fw.c" ], "versions": [ { "version": "5.17", "status": "affected" }, { "version": "0", "lessThan": "5.17", "status": "unaffected", "versionType": "semver" }, { "version": "5.17.2", "lessThanOrEqual": "5.17.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "5.17.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "5.18" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/ec5da191bfcd5fd22b95459b623694f66c1cc10b" }, { "url": "https://git.kernel.org/stable/c/d95984b5580dcb8b1c0036577c52b609990a1dab" } ], "title": "rtw88: fix memory overrun and memory leak during hw_scan", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2022-49231", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2025-10-01T19:46:11.936580Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-401", "description": "CWE-401 Missing Release of Memory after Effective Lifetime" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T19:47:03.648Z" } } ] } }