Vulnerability Description
A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in turn, potentially execute code.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | >= 5.1, < 5.19.16 |
| Fedoraproject | Fedora | 35 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/169951/Kernel-Live-Patch-Security-Notice-LSThird Party AdvisoryVDB Entry
- http://www.openwall.com/lists/oss-security/2022/10/13/5ExploitMailing ListThird Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1204060Issue TrackingPatchThird Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git/commit/?idMailing ListPatchVendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/11/msg00001.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.netapp.com/advisory/ntap-20230203-0008/
- https://www.debian.org/security/2022/dsa-5257Third Party Advisory
- http://packetstormsecurity.com/files/169951/Kernel-Live-Patch-Security-Notice-LSThird Party AdvisoryVDB Entry
- http://www.openwall.com/lists/oss-security/2022/10/13/5ExploitMailing ListThird Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1204060Issue TrackingPatchThird Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git/commit/?idMailing ListPatchVendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/11/msg00001.htmlMailing ListThird Party Advisory
FAQ
What is CVE-2022-42721?
CVE-2022-42721 is a vulnerability with a CVSS score of 5.5 (MEDIUM). A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list...
How severe is CVE-2022-42721?
CVE-2022-42721 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-42721?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Fedoraproject Fedora, Debian Debian Linux.