CVE-2022-50248

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix double free on tx path.

We see kernel crashes and lockups and KASAN errors related to ax210

firmware crashes. One of the KASAN dumps pointed at the tx path,

and it appears there is indeed a way to double-free an skb.

If iwl_mvm_tx_skb_sta returns non-zero, then the 'skb' sent into the

method will be freed. But, in case where we build TSO skb buffer,

the skb may also be freed in error case. So, return 0 in that particular

error case and do cleanup manually.

BUG: KASAN: use-after-free in __list_del_entry_valid+0x12/0x90

iwlwifi 0000:06:00.0: 0x00000000 | tsf hi

Read of size 8 at addr ffff88813cfa4ba0 by task btserver/9650

CPU: 4 PID: 9650 Comm: btserver Tainted: G W 5.19.8+ #5

iwlwifi 0000:06:00.0: 0x00000000 | time gp1

Hardware name: Default string Default string/SKYBAY, BIOS 5.12 02/19/2019

Call Trace:

<TASK>

dump_stack_lvl+0x55/0x6d

print_report.cold.12+0xf2/0x684

iwlw

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References