CVE-2022-50279

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()

There is a global-out-of-bounds reported by KASAN:

BUG: KASAN: global-out-of-bounds in

_rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]

Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411

CPU: 6 PID: 411 Comm: NetworkManager Tainted: G D

6.1.0-rc8+ #144 e15588508517267d37

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),

Call Trace:

<TASK>

...

kasan_report+0xbb/0x1c0

_rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]

rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae]

rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae]

...

</TASK>

The root cause of the problem is that the comparison order of

"prate_section" in _rtl8812ae_phy_set_txpower_limit() is wrong. The

_rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two

strings from tail to head, which causes the problem. I

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References