Remote Yes

Type Arbitrary code execution

Description

A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.14 could be used by remote attackers who are able to inject WLAN frames to corrupt a linked list and, in turn, potentially execute code.

AVG-2803 linux-zen 5.1-1 6.0.1.zen2-1 Critical Fixed

AVG-2802 linux-lts 5.1-1 5.15.73-3 Critical Fixed

AVG-2801 linux 5.1-1 6.0.1.arch4-1 Critical Fixed

AVG-2800 linux-hardened 5.1-1 5.19.15.hardened2-1 Critical Fixed

https://www.openwall.com/lists/oss-security/2022/10/13/2
https://www.openwall.com/lists/oss-security/2022/10/13/5
https://lore.kernel.org/netdev/20221013100522.46346-1-johannes@sipsolutions.net/T/#u
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git/commit/?id=bcca852027e5878aec911a347407ecc88d6fff7f
https://bugzilla.suse.com/show_bug.cgi?id=1204060