CVE-2022-48876

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix initialization of rx->link and rx->link_sta

There are some codepaths that do not initialize rx->link_sta properly. This

causes a crash in places which assume that rx->link_sta is valid if rx->sta

is valid.

One known instance is triggered by __ieee80211_rx_h_amsdu being called from

fast-rx. It results in a crash like this one:

BUG: kernel NULL pointer dereference, address: 00000000000000a8

#PF: supervisor write access in kernel mode

#PF: error_code(0x0002) - not-present page PGD 0 P4D 0

Oops: 0002 [#1] PREEMPT SMP PTI

CPU: 1 PID: 506 Comm: mt76-usb-rx phy Tainted: G E 6.1.0-debian64x+1.7 #3

Hardware name: ZOTAC ZBOX-ID92/ZBOX-IQ01/ZBOX-ID92/ZBOX-IQ01, BIOS B220P007 05/21/2014

RIP: 0010:ieee80211_deliver_skb+0x62/0x1f0 [mac80211]

Code: 00 48 89 04 24 e8 9e a7 c3 df 89 c0 48 03 1c c5 a0 ea 39 a1 4c 01 6b 08 48 ff 03 48

83 7d 28 00 74 11 48 8b 45 30 48 63 55 44 <48> 83

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References