In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: Fix UAF in ieee80211scanrx()
ieee80211scanrx() tries to access scanreq->flags after a null check, but a UAF is observed when the scan is completed and _ieee80211scancompleted() executes, which then calls cfg80211scandone() leading to the freeing of scan_req.
Since scanreq is rcudereference()'d, prevent the racing in _ieee80211scancompleted() by ensuring that from mac80211's POV it is no longer accessed from an RCU read critical section before we call cfg80211scan_done().
[
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326928795427822808396520789204935696045",
"256462752146026211500389456650930284101",
"233154416806771810357962981996877428482",
"77099481635569431809293988877375851199",
"176692283375276172370838317368248773437",
"107652385255933454240287325431407711389",
"194267202875340438588169957738018716393",
"260477517270215753141715457372911164004",
"243783533678698535390598636075160616114",
"210232397480215237977566817910308306528",
"11581352098854996337673856929865136200"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/mac80211/scan.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4abc8c07a065ecf771827bde3c63fbbe4aa0c08b",
"id": "CVE-2022-49934-01934f29"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326928795427822808396520789204935696045",
"256462752146026211500389456650930284101",
"233154416806771810357962981996877428482",
"77099481635569431809293988877375851199",
"176692283375276172370838317368248773437",
"107652385255933454240287325431407711389",
"194267202875340438588169957738018716393",
"260477517270215753141715457372911164004",
"243783533678698535390598636075160616114",
"210232397480215237977566817910308306528",
"11581352098854996337673856929865136200"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/mac80211/scan.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0445feb80a4d0854898118fa01073701f8d356b",
"id": "CVE-2022-49934-09a0314f"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "303628845064244875143582440091654955242",
"length": 1439.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "__ieee80211_scan_completed",
"file": "net/mac80211/scan.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0445feb80a4d0854898118fa01073701f8d356b",
"id": "CVE-2022-49934-417d0f1d"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326928795427822808396520789204935696045",
"256462752146026211500389456650930284101",
"233154416806771810357962981996877428482",
"77099481635569431809293988877375851199",
"176692283375276172370838317368248773437",
"56330551133940610868427797045220654226",
"112240701791110175625502409604042475104",
"243783533678698535390598636075160616114",
"210232397480215237977566817910308306528",
"11581352098854996337673856929865136200"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/mac80211/scan.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ad48cbf8b07f10c1e4a7a262b32a9179ae9dd2d",
"id": "CVE-2022-49934-53c643fb"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326928795427822808396520789204935696045",
"256462752146026211500389456650930284101",
"233154416806771810357962981996877428482",
"77099481635569431809293988877375851199",
"176692283375276172370838317368248773437",
"107652385255933454240287325431407711389",
"194267202875340438588169957738018716393",
"260477517270215753141715457372911164004",
"243783533678698535390598636075160616114",
"210232397480215237977566817910308306528",
"11581352098854996337673856929865136200"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/mac80211/scan.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d20c6f932f2758078d0454729129c894fe353e7",
"id": "CVE-2022-49934-760d97ff"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326928795427822808396520789204935696045",
"256462752146026211500389456650930284101",
"233154416806771810357962981996877428482",
"77099481635569431809293988877375851199",
"176692283375276172370838317368248773437",
"56330551133940610868427797045220654226",
"112240701791110175625502409604042475104",
"243783533678698535390598636075160616114",
"210232397480215237977566817910308306528",
"11581352098854996337673856929865136200"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/mac80211/scan.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78a07732fbb0934d14827d8f09b9aa6a49ee1aa9",
"id": "CVE-2022-49934-888546d1"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "53553062486342020422492270657228363943",
"length": 1407.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "__ieee80211_scan_completed",
"file": "net/mac80211/scan.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6eb181a64fdabf10be9e54de728876667da20255",
"id": "CVE-2022-49934-949c95db"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326928795427822808396520789204935696045",
"256462752146026211500389456650930284101",
"233154416806771810357962981996877428482",
"77099481635569431809293988877375851199",
"176692283375276172370838317368248773437",
"56330551133940610868427797045220654226",
"112240701791110175625502409604042475104",
"243783533678698535390598636075160616114",
"210232397480215237977566817910308306528",
"11581352098854996337673856929865136200"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/mac80211/scan.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6eb181a64fdabf10be9e54de728876667da20255",
"id": "CVE-2022-49934-9b49316c"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "297990430232012243943486817538453857175",
"length": 1439.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "__ieee80211_scan_completed",
"file": "net/mac80211/scan.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ad48cbf8b07f10c1e4a7a262b32a9179ae9dd2d",
"id": "CVE-2022-49934-aafa3220"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "303628845064244875143582440091654955242",
"length": 1439.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "__ieee80211_scan_completed",
"file": "net/mac80211/scan.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60deb9f10eec5c6a20252ed36238b55d8b614a2c",
"id": "CVE-2022-49934-abf5e4e9"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326928795427822808396520789204935696045",
"256462752146026211500389456650930284101",
"233154416806771810357962981996877428482",
"77099481635569431809293988877375851199",
"176692283375276172370838317368248773437",
"56330551133940610868427797045220654226",
"112240701791110175625502409604042475104",
"243783533678698535390598636075160616114",
"210232397480215237977566817910308306528",
"11581352098854996337673856929865136200"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/mac80211/scan.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0ff39448cea654843744c72c6780293c5082cb1",
"id": "CVE-2022-49934-c3afcc7e"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "303628845064244875143582440091654955242",
"length": 1439.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "__ieee80211_scan_completed",
"file": "net/mac80211/scan.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4abc8c07a065ecf771827bde3c63fbbe4aa0c08b",
"id": "CVE-2022-49934-d1d5f994"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "303628845064244875143582440091654955242",
"length": 1439.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "__ieee80211_scan_completed",
"file": "net/mac80211/scan.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d20c6f932f2758078d0454729129c894fe353e7",
"id": "CVE-2022-49934-db0f6a12"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "53553062486342020422492270657228363943",
"length": 1407.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "__ieee80211_scan_completed",
"file": "net/mac80211/scan.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78a07732fbb0934d14827d8f09b9aa6a49ee1aa9",
"id": "CVE-2022-49934-ed7c28d7"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326928795427822808396520789204935696045",
"256462752146026211500389456650930284101",
"233154416806771810357962981996877428482",
"77099481635569431809293988877375851199",
"176692283375276172370838317368248773437",
"107652385255933454240287325431407711389",
"194267202875340438588169957738018716393",
"260477517270215753141715457372911164004",
"243783533678698535390598636075160616114",
"210232397480215237977566817910308306528",
"11581352098854996337673856929865136200"
]
},
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/mac80211/scan.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60deb9f10eec5c6a20252ed36238b55d8b614a2c",
"id": "CVE-2022-49934-f50cda70"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "53553062486342020422492270657228363943",
"length": 1407.0
},
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "__ieee80211_scan_completed",
"file": "net/mac80211/scan.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0ff39448cea654843744c72c6780293c5082cb1",
"id": "CVE-2022-49934-fcb66e28"
}
]