CVE-2022-49022
wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration Fix possible out-of-bound access in ieee80211_get_rate_duration routine as reported by the following UBSAN report: UBSAN: array-index-out-of-bounds in net/mac80211/airtime.c:455:47 index 15 is out of range for type 'u16 [12]' CPU: 2 PID: 217 Comm: kworker/u32:10 Not tainted 6.1.0-060100rc3-generic Hardware name: Acer Aspire TC-281/Aspire TC-281, BIOS R01-A2 07/18/2017 Workqueue: mt76 mt76u_tx_status_data [mt76_usb] Call Trace: <TASK> show_stack+0x4e/0x61 dump_stack_lvl+0x4a/0x6f dump_stack+0x10/0x18 ubsan_epilogue+0x9/0x43 __ubsan_handle_out_of_bounds.cold+0x42/0x47 ieee80211_get_rate_duration.constprop.0+0x22f/0x2a0 [mac80211] ? ieee80211_tx_status_ext+0x32e/0x640 [mac80211] ieee80211_calc_rx_airtime+0xda/0x120 [mac80211] ieee80211_calc_tx_airtime+0xb4/0x100 [mac80211] mt76x02_send_tx_status+0x266/0x480 [mt76x02_lib] mt76x02_tx_status_data+0x52/0x80 [mt76x02_lib] mt76u_tx_status_data+0x67/0xd0 [mt76_usb] process_one_work+0x225/0x400 worker_thread+0x50/0x3e0 ? process_one_work+0x400/0x400 kthread+0xe9/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High8.1 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.34% · top 72% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.
Weakness
Affected products
- affected db3e1c40cf2f973fbdd52ae0b59a9472b1c04f4a – < 0184ede0ec61b9cd075babfaa45081b1bf322234
- affected db3e1c40cf2f973fbdd52ae0b59a9472b1c04f4a – < 59b54f0563b6546c94bdb6823d3b382c75407019
- affected db3e1c40cf2f973fbdd52ae0b59a9472b1c04f4a – < f0fcad4c7201ecfaa17357f4ce0c50b4708df22d
- affected db3e1c40cf2f973fbdd52ae0b59a9472b1c04f4a – < 3e8f7abcc3473bc9603323803aeaed4ffcc3a2ab
- affected 5.5
- unaffected < 5.5
- unaffected 5.10.158 – ≤ 5.10.*
- unaffected 5.15.82 – ≤ 5.15.*
- unaffected 6.0.12 – ≤ 6.0.*
- unaffected 6.1 – ≤ *
References (4)
- https://git.kernel.org/stable/c/0184ede0ec61b9cd075babfaa45081b1bf322234 (opens in a new tab)
- https://git.kernel.org/stable/c/59b54f0563b6546c94bdb6823d3b382c75407019 (opens in a new tab)
- https://git.kernel.org/stable/c/f0fcad4c7201ecfaa17357f4ce0c50b4708df22d (opens in a new tab)
- https://git.kernel.org/stable/c/3e8f7abcc3473bc9603323803aeaed4ffcc3a2ab (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-49022)Record last updated .