CVE-2022-48784
published 2024-07-16CVE-2022-48784: In the Linux kernel, the following vulnerability has been resolved: cfg80211: fix race in netlink owner interface destruction My previous fix here to fix the…
PriorityP414medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.17%
6.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
cfg80211: fix race in netlink owner interface destruction
My previous fix here to fix the deadlock left a race where
the exact same deadlock (see the original commit referenced
below) can still happen if cfg80211_destroy_ifaces() already
runs while nl80211_netlink_notify() is still marking some
interfaces as nl_owner_dead.
The race happens because we have two loops here - first we
dev_close() all the netdevs, and then we destroy them. If we
also have two netdevs (first one need only be a wdev though)
then we can find one during the first iteration, close it,
and go to the second iteration -- but then find two, and try
to destroy also the one we didn't close yet.
Fix this by only iterating once.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.16.11-1 (bookworm) | linux 5.16.11-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 5.12.1 < 5.13 | 5.13 |
| linux | linux | >= ea6b2098dd02789f68770fd3d5a373732207be2f < 241e633cb379c4f332fc1baf2abec95ec840cbeb | 241e633cb379c4f332fc1baf2abec95ec840cbeb |
| linux | linux | >= ea6b2098dd02789f68770fd3d5a373732207be2f < c979f792a2baf6d0f3419587668a1a6eba46a3d2 | c979f792a2baf6d0f3419587668a1a6eba46a3d2 |
| linux | linux | >= ea6b2098dd02789f68770fd3d5a373732207be2f < f0a6fd1527067da537e9c48390237488719948ed | f0a6fd1527067da537e9c48390237488719948ed |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.16.11-1 | 5.16.11-1 |
| linux | linux_kernel | >= 0 < 5.16.11-1 | 5.16.11-1 |
| linux | linux_kernel | >= 0 < 5.16.11-1 | 5.16.11-1 |
| linux | linux_kernel | >= 5.12.1 < 5.15.25 | 5.15.25 |
| linux | linux_kernel | >= 5.16 < 5.16.11 | 5.16.11 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 5.15.24/5.16.10 cfg80211_destroy_ifaces iteration (241e633cb379/c979f792a2ba/f0a6fd152706 / WID-SEC-2024-1625)
vuldb·2026-07-11·CVSS 4.7
CVE-2022-48784 [MEDIUM] Linux Kernel up to 5.15.24/5.16.10 cfg80211_destroy_ifaces iteration (241e633cb379/c979f792a2ba/f0a6fd152706 / WID-SEC-2024-1625)
A vulnerability was found in Linux Kernel up to 5.15.24/5.16.10. It has been classified as critical. This impacts the function cfg80211_destroy_ifaces. The manipulation leads to excessive iteration.
This vulnerability is uniquely identified as CVE-2022-48784. The attack can only be initiated within the local network. No exploit exists.
Upgrading the affected component is recommended.
OSV
CVE-2022-48784: In the Linux kernel, the following vulnerability has been resolved: cfg80211: fix race in netlink owner interface destruction My previous fix here to
osv·2024-07-16·CVSS 4.7
CVE-2022-48784 [MEDIUM] CVE-2022-48784: In the Linux kernel, the following vulnerability has been resolved: cfg80211: fix race in netlink owner interface destruction My previous fix here to
In the Linux kernel, the following vulnerability has been resolved: cfg80211: fix race in netlink owner interface destruction My previous fix here to fix the deadlock left a race where the exact same deadlock (see the original commit referenced below) can still happen if cfg80211_destroy_ifaces() already runs while nl80211_netlink_notify() is still marking some interfaces as nl_owner_dead. The race happens because we have two loops here - first we dev_close() all the netdevs, and then we destroy them. If we also have two netdevs (first one need only be a wdev though) then we can find one during the first iteration, close it, and go to the second iteration -- but then find two, and try to destroy also the one we didn't close yet. Fix this by only iterating once.
GHSA
GHSA-5rjr-qvpw-gg98: In the Linux kernel, the following vulnerability has been resolved:
cfg80211: fix race in netlink owner interface destruction
My previous fix here t
ghsa_unreviewed·2024-07-16
CVE-2022-48784 [MEDIUM] CWE-362 GHSA-5rjr-qvpw-gg98: In the Linux kernel, the following vulnerability has been resolved:
cfg80211: fix race in netlink owner interface destruction
My previous fix here t
In the Linux kernel, the following vulnerability has been resolved:
cfg80211: fix race in netlink owner interface destruction
My previous fix here to fix the deadlock left a race where
the exact same deadlock (see the original commit referenced
below) can still happen if cfg80211_destroy_ifaces() already
runs while nl80211_netlink_notify() is still marking some
interfaces as nl_owner_dead.
The race happens because we have two loops here - first we
dev_close() all the netdevs, and then we destroy them. If we
also have two netdevs (first one need only be a wdev though)
then we can find one during the first iteration, close it,
and go to the second iteration -- but then find two, and try
to destroy also the one we didn't close yet.
Fix this by only iterating once.
Red Hat
kernel: cfg80211: fix race in netlink owner interface destruction
vendor_redhat·2024-07-16·CVSS 4.7
CVE-2022-48784 [MEDIUM] CWE-362 kernel: cfg80211: fix race in netlink owner interface destruction
kernel: cfg80211: fix race in netlink owner interface destruction
In the Linux kernel, the following vulnerability has been resolved:
cfg80211: fix race in netlink owner interface destruction
My previous fix here to fix the deadlock left a race where
the exact same deadlock (see the original commit referenced
below) can still happen if cfg80211_destroy_ifaces() already
runs while nl80211_netlink_notify() is still marking some
interfaces as nl_owner_dead.
The race happens because we have two loops here - first we
dev_close() all the netdevs, and then we destroy them. If we
also have two netdevs (first one need only be a wdev though)
then we can find one during the first iteration, close it,
and go to the second iteration -- but then find two, and try
to destroy also the one we didn't close
Debian
CVE-2022-48784: linux - In the Linux kernel, the following vulnerability has been resolved: cfg80211: f...
vendor_debian·2022·CVSS 4.7
CVE-2022-48784 [MEDIUM] CVE-2022-48784: linux - In the Linux kernel, the following vulnerability has been resolved: cfg80211: f...
In the Linux kernel, the following vulnerability has been resolved: cfg80211: fix race in netlink owner interface destruction My previous fix here to fix the deadlock left a race where the exact same deadlock (see the original commit referenced below) can still happen if cfg80211_destroy_ifaces() already runs while nl80211_netlink_notify() is still marking some interfaces as nl_owner_dead. The race happens because we have two loops here - first we dev_close() all the netdevs, and then we destroy them. If we also have two netdevs (first one need only be a wdev though) then we can find one during the first iteration, close it, and go to the second iteration -- but then find two, and try to destroy also the one we didn't close yet. Fix this by only iterating once.
Scope: local
bookworm: resol
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/241e633cb379c4f332fc1baf2abec95ec840cbebhttps://git.kernel.org/stable/c/c979f792a2baf6d0f3419587668a1a6eba46a3d2https://git.kernel.org/stable/c/f0a6fd1527067da537e9c48390237488719948edhttps://git.kernel.org/stable/c/241e633cb379c4f332fc1baf2abec95ec840cbebhttps://git.kernel.org/stable/c/c979f792a2baf6d0f3419587668a1a6eba46a3d2https://git.kernel.org/stable/c/f0a6fd1527067da537e9c48390237488719948ed
2024-07-16
Published