CVE-2022-49023

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-49023", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-22T01:27:53.649Z", "datePublished": "2024-10-21T20:06:29.901Z", "dateUpdated": "2026-08-05T08:53:30.326Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:53:30.326Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: fix buffer overflow in elem comparison\n\nFor vendor elements, the code here assumes that 5 octets\nare present without checking. Since the element itself is\nalready checked to fit, we only need to check the length."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The bug is reached by injecting crafted 802.11 Beacon/Probe Response frames with Multiple BSSID elements containing short vendor IEs; exploitation requires adjacency on the Wi\u2011Fi RF segment, matching WiFi frame-injection guidance.\nAC:L - An attacker fully controls frame contents and can reliably include a vendor IE with length < 5 in both the transmitted BSS IEs and an MBSSID nontransmitted profile; success does not depend on races or unpredictable victim state beyond ordinary Wi\u2011Fi reception/scanning.\nPR:N - Frames are processed in the unauthenticated scan/MLME RX path before any association or credentials; no local account or capability is required.\nUI:N - cfg80211/mac80211 ingest these management frames during normal scanning and BSS updates without requiring a deliberate user action beyond having Wi\u2011Fi operating.\nS:U - Impact remains within the local kernel\u2019s BSS/IE handling authority; there is no VM, IOMMU, or other security-authority boundary crossing.\nC:L - The defect is a strictly bounded out-of-bounds read of at most 5 bytes used only for vendor-IE matching (small bounded OOB read), not an arbitrary read primitive, so confidentiality impact is Low rather than High.\nI:N - The buggy access is a read-only memcmp; subsequent memcpy lengths still follow validated IE length fields, so this CVE does not provide a write or control-flow integrity primitive.\nA:H - Reading past the end of a kmemdup/slab IE buffer is a memory-safety violation that can fault or oops when the short vendor IE sits at the allocation boundary, so availability impact is High."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/wireless/scan.c"], "versions": [{"version": "0b8fb8235be8be99a197e8d948fc0a2df8dc261a", "lessThan": "f5c2ec288a865dbe3706b09bed12302e9f6d696b", "status": "affected", "versionType": "git"}, {"version": "0b8fb8235be8be99a197e8d948fc0a2df8dc261a", "lessThan": "9e6b79a3cd17620d467311b30d56f2648f6880aa", "status": "affected", "versionType": "git"}, {"version": "0b8fb8235be8be99a197e8d948fc0a2df8dc261a", "lessThan": "88a6fe3707888bd1893e9741157a7035c4159ab6", "status": "affected", "versionType": "git"}, {"version": "0b8fb8235be8be99a197e8d948fc0a2df8dc261a", "lessThan": "391cb872553627bdcf236c03ee7d5adb275e37e1", "status": "affected", "versionType": "git"}, {"version": "0b8fb8235be8be99a197e8d948fc0a2df8dc261a", "lessThan": "9f16b5c82a025cd4c864737409234ddc44fb166a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/wireless/scan.c"], "versions": [{"version": "5.1", "status": "affected"}, {"version": "0", "lessThan": "5.1", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.226", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.158", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.82", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.0.12", "lessThanOrEqual": "6.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.4.226"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.10.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.15.82"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f5c2ec288a865dbe3706b09bed12302e9f6d696b"}, {"url": "https://git.kernel.org/stable/c/9e6b79a3cd17620d467311b30d56f2648f6880aa"}, {"url": "https://git.kernel.org/stable/c/88a6fe3707888bd1893e9741157a7035c4159ab6"}, {"url": "https://git.kernel.org/stable/c/391cb872553627bdcf236c03ee7d5adb275e37e1"}, {"url": "https://git.kernel.org/stable/c/9f16b5c82a025cd4c864737409234ddc44fb166a"}], "title": "wifi: cfg80211: fix buffer overflow in elem comparison", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-49023", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-22T13:12:18.800355Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:18:36.843Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-49023", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-22T13:12:18.800355Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:12:21.863Z"}}], "cna": {"title": "wifi: cfg80211: fix buffer overflow in elem comparison", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The bug is reached by injecting crafted 802.11 Beacon/Probe Response frames with Multiple BSSID elements containing short vendor IEs; exploitation requires adjacency on the Wi\u2011Fi RF segment, matching WiFi frame-injection guidance.\nAC:L - An attacker fully controls frame contents and can reliably include a vendor IE with length < 5 in both the transmitted BSS IEs and an MBSSID nontransmitted profile; success does not depend on races or unpredictable victim state beyond ordinary Wi\u2011Fi reception/scanning.\nPR:N - Frames are processed in the unauthenticated scan/MLME RX path before any association or credentials; no local account or capability is required.\nUI:N - cfg80211/mac80211 ingest these management frames during normal scanning and BSS updates without requiring a deliberate user action beyond having Wi\u2011Fi operating.\nS:U - Impact remains within the local kernel\u2019s BSS/IE handling authority; there is no VM, IOMMU, or other security-authority boundary crossing.\nC:L - The defect is a strictly bounded out-of-bounds read of at most 5 bytes used only for vendor-IE matching (small bounded OOB read), not an arbitrary read primitive, so confidentiality impact is Low rather than High.\nI:N - The buggy access is a read-only memcmp; subsequent memcpy lengths still follow validated IE length fields, so this CVE does not provide a write or control-flow integrity primitive.\nA:H - Reading past the end of a kmemdup/slab IE buffer is a memory-safety violation that can fault or oops when the short vendor IE sits at the allocation boundary, so availability impact is High."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0b8fb8235be8be99a197e8d948fc0a2df8dc261a", "lessThan": "f5c2ec288a865dbe3706b09bed12302e9f6d696b", "versionType": "git"}, {"status": "affected", "version": "0b8fb8235be8be99a197e8d948fc0a2df8dc261a", "lessThan": "9e6b79a3cd17620d467311b30d56f2648f6880aa", "versionType": "git"}, {"status": "affected", "version": "0b8fb8235be8be99a197e8d948fc0a2df8dc261a", "lessThan": "88a6fe3707888bd1893e9741157a7035c4159ab6", "versionType": "git"}, {"status": "affected", "version": "0b8fb8235be8be99a197e8d948fc0a2df8dc261a", "lessThan": "391cb872553627bdcf236c03ee7d5adb275e37e1", "versionType": "git"}, {"status": "affected", "version": "0b8fb8235be8be99a197e8d948fc0a2df8dc261a", "lessThan": "9f16b5c82a025cd4c864737409234ddc44fb166a", "versionType": "git"}], "programFiles": ["net/wireless/scan.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.1"}, {"status": "unaffected", "version": "0", "lessThan": "5.1", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.226", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.158", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.82", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.0.12", "versionType": "semver", "lessThanOrEqual": "6.0.*"}, {"status": "unaffected", "version": "6.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/wireless/scan.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/f5c2ec288a865dbe3706b09bed12302e9f6d696b"}, {"url": "https://git.kernel.org/stable/c/9e6b79a3cd17620d467311b30d56f2648f6880aa"}, {"url": "https://git.kernel.org/stable/c/88a6fe3707888bd1893e9741157a7035c4159ab6"}, {"url": "https://git.kernel.org/stable/c/391cb872553627bdcf236c03ee7d5adb275e37e1"}, {"url": "https://git.kernel.org/stable/c/9f16b5c82a025cd4c864737409234ddc44fb166a"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: fix buffer overflow in elem comparison\n\nFor vendor elements, the code here assumes that 5 octets\nare present without checking. Since the element itself is\nalready checked to fit, we only need to check the length."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.226", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.158", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.82", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.0.12", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1", "versionStartIncluding": "5.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:53:30.326Z"}}}, "cveMetadata": {"cveId": "CVE-2022-49023", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:53:30.326Z", "dateReserved": "2024-08-22T01:27:53.649Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-10-21T20:06:29.901Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/wireless/scan.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f5c2ec288a865dbe3706b09bed12302e9f6d696b", "status": "affected", "version": "0b8fb8235be8be99a197e8d948fc0a2df8dc261a", "versionType": "git"}, {"lessThan": "9e6b79a3cd17620d467311b30d56f2648f6880aa", "status": "affected", "version": "0b8fb8235be8be99a197e8d948fc0a2df8dc261a", "versionType": "git"}, {"lessThan": "88a6fe3707888bd1893e9741157a7035c4159ab6", "status": "affected", "version": "0b8fb8235be8be99a197e8d948fc0a2df8dc261a", "versionType": "git"}, {"lessThan": "391cb872553627bdcf236c03ee7d5adb275e37e1", "status": "affected", "version": "0b8fb8235be8be99a197e8d948fc0a2df8dc261a", "versionType": "git"}, {"lessThan": "9f16b5c82a025cd4c864737409234ddc44fb166a", "status": "affected", "version": "0b8fb8235be8be99a197e8d948fc0a2df8dc261a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/wireless/scan.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.1"}, {"lessThan": "5.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.226", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.158", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.82", "versionType": "semver"}, {"lessThanOrEqual": "6.0.*", "status": "unaffected", "version": "6.0.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3CC306ED-CE15-40C6-9F0E-DB7264BEEC0B", "versionEndExcluding": "5.4.226", "versionStartIncluding": "5.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0FB1AF1-0A0B-4419-B25F-C61F17380E18", "versionEndExcluding": "5.10.158", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0DC20DB6-73C1-4465-B931-117BFB8EBB02", "versionEndExcluding": "5.15.82", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6D56E90-F3EE-413D-B3E2-B518932F0C7D", "versionEndExcluding": "6.0.12", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "17F0B248-42CF-4AE6-A469-BB1BAE7F4705", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "E2422816-0C14-4B5E-A1E6-A9D776E5C49B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "35B26BE4-43A6-4A36-A7F6-5B3F572D9186", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*", "matchCriteriaId": "3FFFB0B3-930D-408A-91E2-BAE0C2715D80", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*", "matchCriteriaId": "8535320E-A0DB-4277-800E-D0CE5BBA59E8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: fix buffer overflow in elem comparison\n\nFor vendor elements, the code here assumes that 5 octets\nare present without checking. Since the element itself is\nalready checked to fit, we only need to check the length."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: cfg80211: se corrige el desbordamiento de b\u00fafer en la comparaci\u00f3n de elementos. Para los elementos del proveedor, el c\u00f3digo aqu\u00ed supone que hay 5 octetos presentes sin verificaci\u00f3n. Dado que el elemento en s\u00ed ya est\u00e1 verificado para que encaje, solo necesitamos verificar la longitud."}], "id": "CVE-2022-49023", "lastModified": "2026-08-04T10:17:31.467", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-49023", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-10-22T13:12:18.800355Z", "version": "2.0.3"}}]}, "published": "2024-10-21T20:15:13.290", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/391cb872553627bdcf236c03ee7d5adb275e37e1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/88a6fe3707888bd1893e9741157a7035c4159ab6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9e6b79a3cd17620d467311b30d56f2648f6880aa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9f16b5c82a025cd4c864737409234ddc44fb166a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f5c2ec288a865dbe3706b09bed12302e9f6d696b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: wifi: cfg80211: fix buffer overflow in elem comparison", "id": "2320768", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2320768"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "status": "draft"}, "cwe": "CWE-120", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: cfg80211: fix buffer overflow in elem comparison\nFor vendor elements, the code here assumes that 5 octets\nare present without checking. Since the element itself is\nalready checked to fit, we only need to check the length.", "A buffer overflow vulnerability was found in the Linux kernel. When performing an elem comparison, no length checking is performed, which can result in the system's loss of availability."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2022-49023", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-10-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-49023\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-49023\nhttps://lore.kernel.org/linux-cve-announce/2024102154-CVE-2022-49023-381d@gregkh/T"], "threat_severity": "Moderate"}

{}