Out-of-bounds write in Linux kernel - CVE-2022-47518

Vulnerability identifier: #VU70625

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-47518

CWE-ID: CWE-787

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing a number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver. A local user can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management frames and execute arbitrary code with elevated privileges.

Linux kernel
Anolis OS
Slackware Linux
Ubuntu
openEuler
kernel-debuginfo
kernel-debugsource
perf-debuginfo
kernel-tools
kernel-tools-debuginfo
kernel-source
bpftool
kernel-devel
python3-perf
perf
bpftool-debuginfo
kernel-tools-devel
kernel
kernel-headers
python3-perf-debuginfo
kernel-debug-modules-extra
kernel-debug-modules
kernel-debug-devel
kernel-modules
kernel-debug-core
kernel-debug
kernel-core
kernel-modules-extra
kernel-tools-libs
kernel-tools-libs-devel
linux-image-generic-lpae (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-lowlatency-64k (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-5.15.0-67-lowlatency (Ubuntu package)
linux-image-5.15.0-67-generic-lpae (Ubuntu package)
linux-image-5.15.0-67-lowlatency-64k (Ubuntu package)
linux-image-5.15.0-67-generic (Ubuntu package)
linux-image-5.15.0-67-generic-64k (Ubuntu package)
linux-image-lowlatency-hwe-20.04 (Ubuntu package)
linux-image-lowlatency-64k-hwe-20.04 (Ubuntu package)
linux-image-generic-lpae-hwe-20.04 (Ubuntu package)
linux-image-generic-64k-hwe-20.04 (Ubuntu package)
linux-image-virtual-hwe-20.04 (Ubuntu package)
linux-image-generic-hwe-20.04 (Ubuntu package)
linux-image-gkeop (Ubuntu package)
linux-image-gkeop-5.15 (Ubuntu package)
linux-image-5.15.0-1016-gkeop (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-raspi-nolpae (Ubuntu package)
linux-image-5.15.0-1025-raspi (Ubuntu package)
linux-image-5.15.0-1025-raspi-nolpae (Ubuntu package)
linux-image-ibm (Ubuntu package)
linux-image-5.15.0-1026-ibm (Ubuntu package)
linux-image-5.15.0-1026-intel-iotg (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-gke-5.15 (Ubuntu package)
linux-image-5.15.0-1028-gke (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-5.15.0-1029-kvm (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-5.15.0-1030-oracle (Ubuntu package)
linux-image-5.15.0-1030-gcp (Ubuntu package)
linux-image-aws-lts-22.04 (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-5.15.0-1031-aws (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-azure-lts-22.04 (Ubuntu package)
linux-image-5.15.0-1034-azure (Ubuntu package)
linux-image-5.15.0-1034-azure-fde (Ubuntu package)
linux-image-azure-fde (Ubuntu package)
linux-5.15.94/kernel-generic
linux-5.15.94/kernel-huge
linux-5.15.94/kernel-modules
linux-5.15.94/kernel-headers
linux-image-5.19.0-35-generic-64k (Ubuntu package)
linux-image-5.19.0-35-generic (Ubuntu package)
linux-image-5.19.0-35-generic-lpae (Ubuntu package)
linux-image-virtual-hwe-22.04 (Ubuntu package)
linux-image-generic-lpae-hwe-22.04 (Ubuntu package)
linux-image-generic-hwe-22.04 (Ubuntu package)
linux-image-generic-64k-hwe-22.04 (Ubuntu package)
linux-image-5.19.0-1014-raspi-nolpae (Ubuntu package)
linux-image-5.19.0-1014-raspi (Ubuntu package)
linux-image-5.19.0-1018-lowlatency (Ubuntu package)
linux-image-5.19.0-1018-lowlatency-64k (Ubuntu package)
linux-image-5.19.0-1018-ibm (Ubuntu package)
linux-image-5.19.0-1018-gcp (Ubuntu package)
linux-image-5.19.0-1018-oracle (Ubuntu package)
linux-image-5.19.0-1019-kvm (Ubuntu package)
linux-image-5.19.0-1020-aws (Ubuntu package)
linux-image-5.19.0-1021-azure (Ubuntu package)
linux-image-intel-iotg (Ubuntu package)

Install updates from vendor's website.

Linux kernel - update to 6.0.11
kernel-debuginfo - update to 5.10.0-60.74.0.98
kernel-debugsource - update to 5.10.0-60.74.0.98
perf-debuginfo - update to 5.10.0-60.74.0.98
kernel-tools - update to 5.10.0-60.74.0.98
kernel-tools-debuginfo - update to 5.10.0-60.74.0.98
kernel-source - update to 5.10.0-60.74.0.98
bpftool - update to 5.10.0-60.74.0.98
kernel-devel - update to 5.10.0-60.74.0.98
python3-perf - update to 5.10.0-60.74.0.98
perf - update to 5.10.0-60.74.0.98
bpftool-debuginfo - update to 5.10.0-60.74.0.98
kernel-tools-devel - update to 5.10.0-60.74.0.98
kernel - update to 5.10.0-60.74.0.98
kernel-headers - update to 5.10.0-60.74.0.98
python3-perf-debuginfo - update to 5.10.0-60.74.0.98
python3-perf - update to 5.10.134-14
kernel-debug-modules-extra - update to 5.10.134-14
kernel-debug-modules - update to 5.10.134-14
kernel-debug-devel - update to 5.10.134-14
kernel-headers - update to 5.10.134-14
kernel-modules - update to 5.10.134-14
kernel-devel - update to 5.10.134-14
kernel-debug-core - update to 5.10.134-14
kernel-debug - update to 5.10.134-14
kernel-core - update to 5.10.134-14
kernel - update to 5.10.134-14
kernel-modules-extra - update to 5.10.134-14
kernel-tools - update to 5.10.134-14
kernel-tools-libs - update to 5.10.134-14
bpftool - update to 5.10.134-14
perf - update to 5.10.134-14
kernel-tools-libs-devel - update to 5.10.134-14
linux-image-generic-lpae (Ubuntu package) - addressed in versions 5.15.0.67.65, 5.19.0.35.32
linux-image-generic (Ubuntu package) - addressed in versions 5.15.0.67.65, 5.19.0.35.32
linux-image-generic-64k (Ubuntu package) - addressed in versions 5.15.0.67.65, 5.19.0.35.32
linux-image-virtual (Ubuntu package) - addressed in versions 5.15.0.67.65, 5.19.0.35.32
linux-image-lowlatency-64k (Ubuntu package) - addressed in versions 5.15.0.67.72, 5.19.0.1018.15
linux-image-lowlatency (Ubuntu package) - addressed in versions 5.15.0.67.72, 5.19.0.1018.15
linux-image-5.15.0-67-lowlatency (Ubuntu package) - addressed in versions 5.15.0-67.74, 5.15.0-67.74~20.04.1
linux-image-5.15.0-67-generic-lpae (Ubuntu package) - addressed in versions 5.15.0-67.74, 5.15.0-67.74~20.04.1
linux-image-5.15.0-67-lowlatency-64k (Ubuntu package) - addressed in versions 5.15.0-67.74, 5.15.0-67.74~20.04.1
linux-image-5.15.0-67-generic (Ubuntu package) - addressed in versions 5.15.0-67.74, 5.15.0-67.74~20.04.1
linux-image-5.15.0-67-generic-64k (Ubuntu package) - addressed in versions 5.15.0-67.74, 5.15.0-67.74~20.04.1
linux-image-lowlatency-hwe-20.04 (Ubuntu package) - update to 5.15.0.67.74~20.04.25
linux-image-lowlatency-64k-hwe-20.04 (Ubuntu package) - update to 5.15.0.67.74~20.04.25
linux-image-generic-lpae-hwe-20.04 (Ubuntu package) - update to 5.15.0.67.74~20.04.28
linux-image-generic-64k-hwe-20.04 (Ubuntu package) - update to 5.15.0.67.74~20.04.28
linux-image-virtual-hwe-20.04 (Ubuntu package) - update to 5.15.0.67.74~20.04.28
linux-image-generic-hwe-20.04 (Ubuntu package) - update to 5.15.0.67.74~20.04.28
linux-image-gkeop (Ubuntu package) - update to 5.15.0.1016.15
linux-image-gkeop-5.15 (Ubuntu package) - update to 5.15.0.1016.15
linux-image-5.15.0-1016-gkeop (Ubuntu package) - update to 5.15.0-1016.21
linux-image-raspi (Ubuntu package) - addressed in versions 5.15.0.1025.22, 5.19.0.1014.13
linux-image-raspi-nolpae (Ubuntu package) - addressed in versions 5.15.0.1025.22, 5.19.0.1014.13
linux-image-5.15.0-1025-raspi (Ubuntu package) - update to 5.15.0-1025.27
linux-image-5.15.0-1025-raspi-nolpae (Ubuntu package) - update to 5.15.0-1025.27
linux-image-ibm (Ubuntu package) - addressed in versions 5.15.0.1026.22, 5.19.0.1018.15
linux-image-intel-iotg (Ubuntu package) - update to 5.15.0.1026.25
linux-image-5.15.0-1026-ibm (Ubuntu package) - update to 5.15.0-1026.29
linux-image-5.15.0-1026-intel-iotg (Ubuntu package) - update to 5.15.0-1026.31
linux-image-gke (Ubuntu package) - update to 5.15.0.1028.27
linux-image-gke-5.15 (Ubuntu package) - addressed in versions 5.15.0.1028.27, 5.15.0.1028.33~20.04.1
linux-image-5.15.0-1028-gke (Ubuntu package) - addressed in versions 5.15.0-1028.33, 5.15.0-1028.33~20.04.1
linux-image-kvm (Ubuntu package) - addressed in versions 5.15.0.1029.25, 5.19.0.1019.16
linux-image-5.15.0-1029-kvm (Ubuntu package) - update to 5.15.0-1029.34
linux-image-oracle (Ubuntu package) - addressed in versions 5.15.0.1030.25, 5.15.0.1030.36~20.04.1, 5.19.0.1018.15
linux-image-gcp (Ubuntu package) - addressed in versions 5.15.0.1030.25, 5.15.0.1030.37~20.04.1, 5.19.0.1018.15
linux-image-5.15.0-1030-oracle (Ubuntu package) - addressed in versions 5.15.0-1030.36, 5.15.0-1030.36~20.04.1
linux-image-5.15.0-1030-gcp (Ubuntu package) - addressed in versions 5.15.0-1030.37, 5.15.0-1030.37~20.04.1
linux-image-aws-lts-22.04 (Ubuntu package) - update to 5.15.0.1031.29
linux-image-aws (Ubuntu package) - addressed in versions 5.15.0.1031.29, 5.15.0.1031.35~20.04.20, 5.19.0.1020.17
linux-image-5.15.0-1031-aws (Ubuntu package) - addressed in versions 5.15.0-1031.35, 5.15.0-1031.35~20.04.1
linux-image-azure (Ubuntu package) - addressed in versions 5.15.0.1034.30, 5.15.0.1034.41~20.04.24, 5.19.0.1021.17
linux-image-azure-lts-22.04 (Ubuntu package) - update to 5.15.0.1034.30
linux-image-5.15.0-1034-azure (Ubuntu package) - addressed in versions 5.15.0-1034.41, 5.15.0-1034.41~20.04.1
linux-image-5.15.0-1034-azure-fde (Ubuntu package) - update to 5.15.0-1034.41.1
linux-image-azure-fde (Ubuntu package) - update to 5.15.0.1034.41.11
linux-5.15.94/kernel-generic - update to 5.15.94
linux-5.15.94/kernel-huge - update to 5.15.94
linux-5.15.94/kernel-modules - update to 5.15.94
linux-5.15.94/kernel-headers - update to 5.15.94_smp
linux-image-5.19.0-35-generic-64k (Ubuntu package) - addressed in versions 5.19.0-35.36, 5.19.0-35.36~22.04.1
linux-image-5.19.0-35-generic (Ubuntu package) - addressed in versions 5.19.0-35.36, 5.19.0-35.36~22.04.1
linux-image-5.19.0-35-generic-lpae (Ubuntu package) - addressed in versions 5.19.0-35.36, 5.19.0-35.36~22.04.1
linux-image-virtual-hwe-22.04 (Ubuntu package) - update to 5.19.0.35.36~22.04.10
linux-image-generic-lpae-hwe-22.04 (Ubuntu package) - update to 5.19.0.35.36~22.04.10
linux-image-generic-hwe-22.04 (Ubuntu package) - update to 5.19.0.35.36~22.04.10
linux-image-generic-64k-hwe-22.04 (Ubuntu package) - update to 5.19.0.35.36~22.04.10
linux-image-5.19.0-1014-raspi-nolpae (Ubuntu package) - update to 5.19.0-1014.21
linux-image-5.19.0-1014-raspi (Ubuntu package) - update to 5.19.0-1014.21
linux-image-5.19.0-1018-lowlatency (Ubuntu package) - update to 5.19.0-1018.19
linux-image-5.19.0-1018-lowlatency-64k (Ubuntu package) - update to 5.19.0-1018.19
linux-image-5.19.0-1018-ibm (Ubuntu package) - update to 5.19.0-1018.20
linux-image-5.19.0-1018-gcp (Ubuntu package) - update to 5.19.0-1018.20
linux-image-5.19.0-1018-oracle (Ubuntu package) - update to 5.19.0-1018.21
linux-image-5.19.0-1019-kvm (Ubuntu package) - update to 5.19.0-1019.20
linux-image-5.19.0-1020-aws (Ubuntu package) - update to 5.19.0-1020.21
linux-image-5.19.0-1021-azure (Ubuntu package) - update to 5.19.0-1021.22

• https://lore.kernel.org/r/20221123153543.8568-5-philipturnbull@github.com
• https://github.com/torvalds/linux/commit/0cdfa9e6f0915e3d243e2393bfa8a22e12d553b0
• https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html

• Multiple vulnerabilities in Linux kernel WILC1000 wireless driver
• Slackware Linux update for kernel
• Ubuntu update for linux
• Ubuntu update for linux
• Ubuntu update for linux-raspi
• Ubuntu update for linux-ibm
• Ubuntu update for linux-gkeop
• Ubuntu update for linux-kvm
• Ubuntu update for linux-kvm
• Ubuntu update for linux-intel-iotg
• openEuler 22.03 LTS update for kernel
• Anolis OS update for kernel