CVE-2022-48787

Source
https://nvd.nist.gov/vuln/detail/CVE-2022-48787
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48787.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-48787
Downstream
Related
Published
2024-07-16T12:15:03Z
Modified
2025-08-09T19:01:28Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

iwlwifi: fix use-after-free

If no firmware was present at all (or, presumably, all of the firmware files failed to parse), we end up unbinding by calling devicereleasedriver(), which calls remove(), which then in iwlwifi calls iwldrvstop(), freeing the 'drv' struct. However the new code I added will still erroneously access it after it was freed.

Set 'failure=false' in this case to avoid the access, all data was already freed anyway.

References

Affected packages