CVE-2022-48875

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: sdata can be NULL during AMPDU start

ieee80211_tx_ba_session_handle_start() may get NULL for sdata when a

deauthentication is ongoing.

Here a trace triggering the race with the hostapd test

multi_ap_fronthaul_on_ap:

(gdb) list *drv_ampdu_action+0x46

0x8b16 is in drv_ampdu_action (net/mac80211/driver-ops.c:396).

391 int ret = -EOPNOTSUPP;

392

393 might_sleep();

394

395 sdata = get_bss_sdata(sdata);

396 if (!check_sdata_in_driver(sdata))

397 return -EIO;

398

399 trace_drv_ampdu_action(local, sdata, params);

400

wlan0: moving STA 02:00:00:00:03:00 to state 3

wlan0: associated

wlan0: deauthenticating from 02:00:00:00:03:00 by local choice (Reason: 3=DEAUTH_LEAVING)

wlan3.sta1: Open BA session requested for 02:00:00:00:00:00 tid 0

wlan3.sta1: dropped frame to 02:00:00:00:00:00 (unauthorized port)

wlan0: moving STA 02:00:00:0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References