Vulnerability Description
A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and potentially execute code.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | >= 5.2, < 5.4.219 |
| Fedoraproject | Fedora | 35 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/171005/Kernel-Live-Patch-Security-Notice-LN
- http://www.openwall.com/lists/oss-security/2022/10/13/2Mailing ListPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2022/10/13/5ExploitMailing ListThird Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1204051Issue TrackingPatchThird Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git/commit/?idMailing ListPatchVendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/11/msg00001.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.netapp.com/advisory/ntap-20230203-0008/
- https://www.debian.org/security/2022/dsa-5257Third Party Advisory
- http://packetstormsecurity.com/files/171005/Kernel-Live-Patch-Security-Notice-LN
- http://www.openwall.com/lists/oss-security/2022/10/13/2Mailing ListPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2022/10/13/5ExploitMailing ListThird Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1204051Issue TrackingPatchThird Party Advisory
FAQ
What is CVE-2022-42719?
CVE-2022-42719 is a vulnerability with a CVSS score of 8.8 (HIGH). A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the ker...
How severe is CVE-2022-42719?
CVE-2022-42719 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-42719?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Fedoraproject Fedora, Debian Debian Linux.