In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: fix use-after-free in chanctx code
In ieee80211vifusereservedcontext(), when we have an old context and the new context's replacestate is set to IEEE80211CHANCTXREPLACENONE, we free the old context in ieee80211vifusereservedreassign(). Therefore, we cannot check the old_ctx anymore, so we should set it to NULL after this point.
However, since the newctx replace state is clearly not IEEE80211CHANCTXREPLACESOTHER, we're not going to do anything else in this function and can just return to avoid accessing the freed old_ctx.
[
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b79110f2bf6022e60e590d2e094728a8eec3e79e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"157741173651258730742639280567549362243",
"84468396583015049178101711451650337522",
"266296583893635263443307436954059122185",
"178618749441833812806098273323231631887",
"325681911005199045091480440224696003126",
"318454953345445359889663615699748214938",
"219431877809757453535519570496187422875",
"36069146816878224318483324981534328562"
]
},
"target": {
"file": "net/mac80211/chan.c"
},
"id": "CVE-2022-49416-10cb678b",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6118bbdf69f4718b02d26bbcf2e497eb66004331",
"digest": {
"function_hash": "267027582014191291453795914366972907782",
"length": 1006.0
},
"target": {
"function": "ieee80211_vif_use_reserved_context",
"file": "net/mac80211/chan.c"
},
"id": "CVE-2022-49416-228de3fd",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b79110f2bf6022e60e590d2e094728a8eec3e79e",
"digest": {
"function_hash": "267027582014191291453795914366972907782",
"length": 1006.0
},
"target": {
"function": "ieee80211_vif_use_reserved_context",
"file": "net/mac80211/chan.c"
},
"id": "CVE-2022-49416-267bdafb",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@88cc8f963febe192d6ded9df7217f92f380b449a",
"digest": {
"function_hash": "267027582014191291453795914366972907782",
"length": 1006.0
},
"target": {
"function": "ieee80211_vif_use_reserved_context",
"file": "net/mac80211/chan.c"
},
"id": "CVE-2022-49416-36e22102",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@265bec4779a38b65e86a25120370f200822dfa76",
"digest": {
"function_hash": "267027582014191291453795914366972907782",
"length": 1006.0
},
"target": {
"function": "ieee80211_vif_use_reserved_context",
"file": "net/mac80211/chan.c"
},
"id": "CVE-2022-49416-3a8604b6",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82c8e7bbdd06c7ed58e22450cc5b37f33a25bb2c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"157741173651258730742639280567549362243",
"84468396583015049178101711451650337522",
"266296583893635263443307436954059122185",
"178618749441833812806098273323231631887",
"325681911005199045091480440224696003126",
"318454953345445359889663615699748214938",
"219431877809757453535519570496187422875",
"36069146816878224318483324981534328562"
]
},
"target": {
"file": "net/mac80211/chan.c"
},
"id": "CVE-2022-49416-3b0ca85b",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ba81e794f0fad6234f644c2da1ae14d5b95e1c4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"157741173651258730742639280567549362243",
"84468396583015049178101711451650337522",
"266296583893635263443307436954059122185",
"178618749441833812806098273323231631887",
"325681911005199045091480440224696003126",
"318454953345445359889663615699748214938",
"219431877809757453535519570496187422875",
"36069146816878224318483324981534328562"
]
},
"target": {
"file": "net/mac80211/chan.c"
},
"id": "CVE-2022-49416-3d4ab3a1",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2965c4cdf7ad9ce0796fac5e57debb9519ea721e",
"digest": {
"function_hash": "267027582014191291453795914366972907782",
"length": 1006.0
},
"target": {
"function": "ieee80211_vif_use_reserved_context",
"file": "net/mac80211/chan.c"
},
"id": "CVE-2022-49416-61b66051",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@265bec4779a38b65e86a25120370f200822dfa76",
"digest": {
"threshold": 0.9,
"line_hashes": [
"157741173651258730742639280567549362243",
"84468396583015049178101711451650337522",
"266296583893635263443307436954059122185",
"178618749441833812806098273323231631887",
"325681911005199045091480440224696003126",
"318454953345445359889663615699748214938",
"219431877809757453535519570496187422875",
"36069146816878224318483324981534328562"
]
},
"target": {
"file": "net/mac80211/chan.c"
},
"id": "CVE-2022-49416-7a192551",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f1e5cc85ad77e52f54049a94db0407445ae2a34",
"digest": {
"function_hash": "267027582014191291453795914366972907782",
"length": 1006.0
},
"target": {
"function": "ieee80211_vif_use_reserved_context",
"file": "net/mac80211/chan.c"
},
"id": "CVE-2022-49416-8025e6c8",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2965c4cdf7ad9ce0796fac5e57debb9519ea721e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"157741173651258730742639280567549362243",
"84468396583015049178101711451650337522",
"266296583893635263443307436954059122185",
"178618749441833812806098273323231631887",
"325681911005199045091480440224696003126",
"318454953345445359889663615699748214938",
"219431877809757453535519570496187422875",
"36069146816878224318483324981534328562"
]
},
"target": {
"file": "net/mac80211/chan.c"
},
"id": "CVE-2022-49416-9b435e81",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f05a9e15edcdf5b97e0d86ab6ecd5f187289f6c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"157741173651258730742639280567549362243",
"84468396583015049178101711451650337522",
"266296583893635263443307436954059122185",
"178618749441833812806098273323231631887",
"325681911005199045091480440224696003126",
"318454953345445359889663615699748214938",
"219431877809757453535519570496187422875",
"36069146816878224318483324981534328562"
]
},
"target": {
"file": "net/mac80211/chan.c"
},
"id": "CVE-2022-49416-a263e3dc",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f05a9e15edcdf5b97e0d86ab6ecd5f187289f6c",
"digest": {
"function_hash": "267027582014191291453795914366972907782",
"length": 1006.0
},
"target": {
"function": "ieee80211_vif_use_reserved_context",
"file": "net/mac80211/chan.c"
},
"id": "CVE-2022-49416-a37476e1",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82c8e7bbdd06c7ed58e22450cc5b37f33a25bb2c",
"digest": {
"function_hash": "267027582014191291453795914366972907782",
"length": 1006.0
},
"target": {
"function": "ieee80211_vif_use_reserved_context",
"file": "net/mac80211/chan.c"
},
"id": "CVE-2022-49416-bb6453f8",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ba81e794f0fad6234f644c2da1ae14d5b95e1c4",
"digest": {
"function_hash": "267027582014191291453795914366972907782",
"length": 1006.0
},
"target": {
"function": "ieee80211_vif_use_reserved_context",
"file": "net/mac80211/chan.c"
},
"id": "CVE-2022-49416-bd0e659c",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f1e5cc85ad77e52f54049a94db0407445ae2a34",
"digest": {
"threshold": 0.9,
"line_hashes": [
"157741173651258730742639280567549362243",
"84468396583015049178101711451650337522",
"266296583893635263443307436954059122185",
"178618749441833812806098273323231631887",
"325681911005199045091480440224696003126",
"318454953345445359889663615699748214938",
"219431877809757453535519570496187422875",
"36069146816878224318483324981534328562"
]
},
"target": {
"file": "net/mac80211/chan.c"
},
"id": "CVE-2022-49416-c41d48b2",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@88cc8f963febe192d6ded9df7217f92f380b449a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"157741173651258730742639280567549362243",
"84468396583015049178101711451650337522",
"266296583893635263443307436954059122185",
"178618749441833812806098273323231631887",
"325681911005199045091480440224696003126",
"318454953345445359889663615699748214938",
"219431877809757453535519570496187422875",
"36069146816878224318483324981534328562"
]
},
"target": {
"file": "net/mac80211/chan.c"
},
"id": "CVE-2022-49416-db4c47c6",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6118bbdf69f4718b02d26bbcf2e497eb66004331",
"digest": {
"threshold": 0.9,
"line_hashes": [
"157741173651258730742639280567549362243",
"84468396583015049178101711451650337522",
"266296583893635263443307436954059122185",
"178618749441833812806098273323231631887",
"325681911005199045091480440224696003126",
"318454953345445359889663615699748214938",
"219431877809757453535519570496187422875",
"36069146816878224318483324981534328562"
]
},
"target": {
"file": "net/mac80211/chan.c"
},
"id": "CVE-2022-49416-ef6f0d5e",
"signature_version": "v1",
"signature_type": "Line"
}
]