Vulnerability Description
Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-free conditions to potentially execute code.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | >= 5.1, < 5.4.218 |
| Fedoraproject | Fedora | 36 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/169951/Kernel-Live-Patch-Security-Notice-LSThird Party AdvisoryVDB Entry
- http://www.openwall.com/lists/oss-security/2022/10/13/5ExploitMailing ListThird Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1204059Issue TrackingPatchThird Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git/commit/?idMailing ListPatchVendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/11/msg00001.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.netapp.com/advisory/ntap-20230203-0008/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5257Third Party Advisory
- http://packetstormsecurity.com/files/169951/Kernel-Live-Patch-Security-Notice-LSThird Party AdvisoryVDB Entry
- http://www.openwall.com/lists/oss-security/2022/10/13/5ExploitMailing ListThird Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1204059Issue TrackingPatchThird Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git/commit/?idMailing ListPatchVendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/11/msg00001.htmlMailing ListThird Party Advisory
FAQ
What is CVE-2022-42720?
CVE-2022-42720 is a vulnerability with a CVSS score of 7.8 (HIGH). Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger ...
How severe is CVE-2022-42720?
CVE-2022-42720 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-42720?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Fedoraproject Fedora, Debian Debian Linux.