In the Linux kernel, the following vulnerability has been resolved:
mac80211: fix potential double free on mesh join
While commit 6a01afcf8468 ("mac80211: mesh: Free ie data when leaving mesh") fixed a memory leak on mesh leave / teardown it introduced a potential memory corruption caused by a double free when rejoining the mesh:
ieee80211leavemesh() -> kfree(sdata->u.mesh.ie); ... ieee80211joinmesh() -> copymeshsetup() -> oldie = ifmsh->ie; -> kfree(oldie);
This double free / kernel panics can be reproduced by using wpa_supplicant with an encrypted mesh (if set up without encryption via "iw" then ifmsh->ie is always NULL, which avoids this issue). And then calling:
$ iw dev mesh0 mesh leave $ iw dev mesh0 mesh join my-mesh
Note that typically these commands are not used / working when using wpasupplicant. And it seems that wpasupplicant or wpacli are going through a NETDEVDOWN/NETDEVUP cycle between a mesh leave and mesh join where the NETDEVUP resets the mesh.ie to NULL via a memcpy of defaultmeshsetup in cfg80211netdevnotifier_call, which then avoids the memory corruption, too.
The issue was first observed in an application which was not using wpa_supplicant but "Senf" instead, which implements its own calls to nl80211.
Fixing the issue by removing the kfree()'ing of the mesh IE in the mesh join function and leaving it solely up to the mesh leave to free the mesh IE.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@582d8c60c0c053684f7138875e8150d5749ffc17",
"target": {
"function": "copy_mesh_setup",
"file": "net/mac80211/cfg.c"
},
"digest": {
"function_hash": "234941135937364070776452780657260311076",
"length": 1719.0
},
"deprecated": false,
"id": "CVE-2022-49290-024f4470",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@582d8c60c0c053684f7138875e8150d5749ffc17",
"target": {
"file": "net/mac80211/cfg.c"
},
"digest": {
"line_hashes": [
"205504455288355039400753135826638801087",
"317071582784525764060487902006973549262",
"270676517132432440719445565626453824851",
"164126231744535219069899479097408578490",
"57676760819499304371067600720594265850",
"188995587649997044130546099686056646147",
"8391670384624840805169010295852304324",
"178375225050713461241509043643327062536",
"116199443476758323896783479685596528210",
"233019702210969876736180332974884709526",
"123913845753963611384637767277191154197",
"99283296724575175525771683399428809",
"169347995451302149716706213980216559483"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-49290-19f9c6f4",
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46bb87d40683337757a2f902fcd4244b32bb4e86",
"target": {
"function": "copy_mesh_setup",
"file": "net/mac80211/cfg.c"
},
"digest": {
"function_hash": "234941135937364070776452780657260311076",
"length": 1719.0
},
"deprecated": false,
"id": "CVE-2022-49290-2209e912",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3bbd0000d012f92aec423b224784fbf0f7bf40f8",
"target": {
"function": "copy_mesh_setup",
"file": "net/mac80211/cfg.c"
},
"digest": {
"function_hash": "23816410790526941604929015080716023937",
"length": 1356.0
},
"deprecated": false,
"id": "CVE-2022-49290-29d43412",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@615716af8644813355e014314a0bc1e961250f5a",
"target": {
"file": "net/mac80211/cfg.c"
},
"digest": {
"line_hashes": [
"205504455288355039400753135826638801087",
"317071582784525764060487902006973549262",
"270676517132432440719445565626453824851",
"105950971143375392258667096665341146950",
"137149767751613801038989999528931814934",
"44410602867286831035613737646518921885",
"178375225050713461241509043643327062536",
"116199443476758323896783479685596528210",
"233019702210969876736180332974884709526",
"123913845753963611384637767277191154197",
"99283296724575175525771683399428809",
"169347995451302149716706213980216559483"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-49290-529a92aa",
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@273ebddc5fda2967492cb0b6cdd7d81cfb821b76",
"target": {
"file": "net/mac80211/cfg.c"
},
"digest": {
"line_hashes": [
"205504455288355039400753135826638801087",
"317071582784525764060487902006973549262",
"270676517132432440719445565626453824851",
"105950971143375392258667096665341146950",
"137149767751613801038989999528931814934",
"44410602867286831035613737646518921885",
"178375225050713461241509043643327062536",
"116199443476758323896783479685596528210",
"233019702210969876736180332974884709526",
"123913845753963611384637767277191154197",
"99283296724575175525771683399428809",
"169347995451302149716706213980216559483"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-49290-5f74b23c",
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1d9c3628ef0a0ca197595d0f9e01cd3b5dda186",
"target": {
"file": "net/mac80211/cfg.c"
},
"digest": {
"line_hashes": [
"205504455288355039400753135826638801087",
"317071582784525764060487902006973549262",
"270676517132432440719445565626453824851",
"105950971143375392258667096665341146950",
"137149767751613801038989999528931814934",
"44410602867286831035613737646518921885",
"178375225050713461241509043643327062536",
"116199443476758323896783479685596528210",
"233019702210969876736180332974884709526",
"123913845753963611384637767277191154197",
"99283296724575175525771683399428809",
"169347995451302149716706213980216559483"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-49290-88070a06",
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a2d4496e15ea5bb5c8e83b94ca8ca7fb045e7d3",
"target": {
"function": "copy_mesh_setup",
"file": "net/mac80211/cfg.c"
},
"digest": {
"function_hash": "234941135937364070776452780657260311076",
"length": 1719.0
},
"deprecated": false,
"id": "CVE-2022-49290-9248442c",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a2d4496e15ea5bb5c8e83b94ca8ca7fb045e7d3",
"target": {
"file": "net/mac80211/cfg.c"
},
"digest": {
"line_hashes": [
"205504455288355039400753135826638801087",
"317071582784525764060487902006973549262",
"270676517132432440719445565626453824851",
"164126231744535219069899479097408578490",
"57676760819499304371067600720594265850",
"188995587649997044130546099686056646147",
"8391670384624840805169010295852304324",
"178375225050713461241509043643327062536",
"116199443476758323896783479685596528210",
"233019702210969876736180332974884709526",
"123913845753963611384637767277191154197",
"99283296724575175525771683399428809",
"169347995451302149716706213980216559483"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-49290-93575355",
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3bbd0000d012f92aec423b224784fbf0f7bf40f8",
"target": {
"file": "net/mac80211/cfg.c"
},
"digest": {
"line_hashes": [
"205504455288355039400753135826638801087",
"317071582784525764060487902006973549262",
"270676517132432440719445565626453824851",
"105950971143375392258667096665341146950",
"137149767751613801038989999528931814934",
"44410602867286831035613737646518921885",
"178375225050713461241509043643327062536",
"116199443476758323896783479685596528210",
"233019702210969876736180332974884709526",
"123913845753963611384637767277191154197",
"99283296724575175525771683399428809",
"169347995451302149716706213980216559483"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-49290-97ad80e2",
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46bb87d40683337757a2f902fcd4244b32bb4e86",
"target": {
"file": "net/mac80211/cfg.c"
},
"digest": {
"line_hashes": [
"205504455288355039400753135826638801087",
"317071582784525764060487902006973549262",
"270676517132432440719445565626453824851",
"164126231744535219069899479097408578490",
"57676760819499304371067600720594265850",
"188995587649997044130546099686056646147",
"8391670384624840805169010295852304324",
"178375225050713461241509043643327062536",
"116199443476758323896783479685596528210",
"233019702210969876736180332974884709526",
"123913845753963611384637767277191154197",
"99283296724575175525771683399428809",
"169347995451302149716706213980216559483"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-49290-9940f380",
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12e407a8ef17623823fd0c066fbd7f103953d28d",
"target": {
"file": "net/mac80211/cfg.c"
},
"digest": {
"line_hashes": [
"205504455288355039400753135826638801087",
"317071582784525764060487902006973549262",
"270676517132432440719445565626453824851",
"164126231744535219069899479097408578490",
"57676760819499304371067600720594265850",
"188995587649997044130546099686056646147",
"8391670384624840805169010295852304324",
"178375225050713461241509043643327062536",
"116199443476758323896783479685596528210",
"233019702210969876736180332974884709526",
"123913845753963611384637767277191154197",
"99283296724575175525771683399428809",
"169347995451302149716706213980216559483"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-49290-a9d20f0b",
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12e407a8ef17623823fd0c066fbd7f103953d28d",
"target": {
"function": "copy_mesh_setup",
"file": "net/mac80211/cfg.c"
},
"digest": {
"function_hash": "234941135937364070776452780657260311076",
"length": 1719.0
},
"deprecated": false,
"id": "CVE-2022-49290-ac0d41d0",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@615716af8644813355e014314a0bc1e961250f5a",
"target": {
"function": "copy_mesh_setup",
"file": "net/mac80211/cfg.c"
},
"digest": {
"function_hash": "299075353668283506815683436452327803771",
"length": 1290.0
},
"deprecated": false,
"id": "CVE-2022-49290-ae3a65df",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d3ff9542a40ce034416bca03864709540a36016",
"target": {
"file": "net/mac80211/cfg.c"
},
"digest": {
"line_hashes": [
"205504455288355039400753135826638801087",
"317071582784525764060487902006973549262",
"270676517132432440719445565626453824851",
"164126231744535219069899479097408578490",
"57676760819499304371067600720594265850",
"188995587649997044130546099686056646147",
"8391670384624840805169010295852304324",
"178375225050713461241509043643327062536",
"116199443476758323896783479685596528210",
"233019702210969876736180332974884709526",
"123913845753963611384637767277191154197",
"99283296724575175525771683399428809",
"169347995451302149716706213980216559483"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-49290-b7f02411",
"signature_type": "Line",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d3ff9542a40ce034416bca03864709540a36016",
"target": {
"function": "copy_mesh_setup",
"file": "net/mac80211/cfg.c"
},
"digest": {
"function_hash": "234941135937364070776452780657260311076",
"length": 1719.0
},
"deprecated": false,
"id": "CVE-2022-49290-d553eea2",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@273ebddc5fda2967492cb0b6cdd7d81cfb821b76",
"target": {
"function": "copy_mesh_setup",
"file": "net/mac80211/cfg.c"
},
"digest": {
"function_hash": "23816410790526941604929015080716023937",
"length": 1356.0
},
"deprecated": false,
"id": "CVE-2022-49290-e16b7f46",
"signature_type": "Function",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1d9c3628ef0a0ca197595d0f9e01cd3b5dda186",
"target": {
"function": "copy_mesh_setup",
"file": "net/mac80211/cfg.c"
},
"digest": {
"function_hash": "23816410790526941604929015080716023937",
"length": 1356.0
},
"deprecated": false,
"id": "CVE-2022-49290-f1bf6489",
"signature_type": "Function",
"signature_version": "v1"
}
]