CVE-2022-47521 — Out-of-bounds Write in Kernel

CWE-787 — Out-of-bounds WriteCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer20 documents7 sources
Severity
7.8HIGHNVD
OSV5.5
EPSS
0.1%
top 64.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Linux KernelDebian LinuxDebian Linux+2 more
Timeline
PublishedDec 18
Latest updateMar 16

Description

An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_CHANNEL_LIST in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages6 packages

▶NVDlinux/linux_kernel5.7 — 5.10.157+2
▶Debianlinux/linux_kernel< 5.10.158-1+3
▶Ubuntulinux/linux_kernel< 5.15.0-67.74
▶debiandebian/linux< linux 6.0.12-1 (bookworm)

Also affects: Debian Linux 10.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

8
OSV
linux-intel-iotg vulnerabilities↗2023-03-16
▶
OSV
linux-kvm vulnerabilities↗2023-03-09
▶
OSV
linux-gkeop vulnerabilities↗2023-03-08
▶
OSV
linux-ibm, linux-raspi vulnerabilities↗2023-03-07
▶
OSV
linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-azure-fde, linux-gcp, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-hwe-5.15, linux-lowlatency, linux-lowlatency-hwe-5.15, lin↗2023-03-02
▶

📋Vendor Advisories

11
Ubuntu
Linux kernel (Intel IoTG) vulnerabilities↗2023-03-16
▶
Ubuntu
Linux kernel (KVM) vulnerabilities↗2023-03-14
▶
Ubuntu
Linux kernel (KVM) vulnerabilities↗2023-03-09
▶
Ubuntu
Linux kernel (GKE) vulnerabilities↗2023-03-08
▶
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities↗2023-03-07
▶