CVE-2022-41674

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.19.16

Description An issue in the Linux kernel allows attackers who can inject WLAN frames to cause a buffer overflow in the ieee80211 bss info update function in net/mac80211/scan.c. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. The issue is also related to an integer overflow in the cfg80211 update notlisted nontrans function in net/wireless/scan.c, which could result in an out of bounds write.

Recommendations For Linux kernel versions prior to 5.19.16, update to version 5.19.16 or later to resolve the issue. As a temporary workaround, consider restricting access to WLAN frames to minimize the risk of exploitation. Additionally, disabling the ieee80211 bss info update function or restricting the use of the cfg80211 update notlisted nontrans function in net/wireless/scan.c could help mitigate the risk until a patch is applied.