CVE-2022-49231

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-49231", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-02-26T01:49:39.293Z", "datePublished": "2025-02-26T01:55:58.139Z", "dateUpdated": "2026-08-05T08:54:25.244Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:54:25.244Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtw88: fix memory overrun and memory leak during hw_scan\n\nPreviously we allocated less memory than actual required, overwrite\nto the buffer causes the mm module to complaint and raise access\nviolation faults. Along with potential memory leaks when returned\nearly. Fix these by passing the correct size and proper deinit flow."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in rtw88 local hw_scan setup (rtw_ops_hw_scan \u2192 rtw_hw_scan_update_probe_req), reached only via nl80211 TRIGGER_SCAN / mac80211 hw_scan\u2014not by processing Wi\u2011Fi frames from the air.\nAC:L - On a dual-band rtw88 device with scan-offload firmware, an attacker who can issue a scan with \u22651 SSID reliably drives num_ssids\u00d7bands probes into an undersized heap buffer; no race or external layout precondition is required.\nPR:L - NL80211_CMD_TRIGGER_SCAN uses GENL_UNS_ADMIN_PERM (CAP_NET_ADMIN in the wiphy netns user_ns). mac80211 sets WIPHY_FLAG_NETNS_OK, so when the WLAN device is in a user/net namespace that capability is available without real init-namespace root.\nUI:N - The attacker triggers the scan themselves through nl80211; no separate victim action (mount, open, click) is required.\nS:U - Impact is heap corruption and potential privilege escalation within the host kernel\u2019s security authority, not a VM escape, IOMMU bypass, or other cross-boundary break.\nC:H - The undersized kzalloc followed by memcpy of multiple probe skbs is a heap out-of-bounds write that can be leveraged for adjacent-object disclosure primitives; guidance treats such memory corruption as Confidentiality High.\nI:H - Probe request contents (SSIDs/IEs) are attacker-influenced and are memcpy\u2019d past the allocated buffer (up to ~2KB with 4 SSIDs\u00d72 bands), yielding a heap OOB write usable for corruption and control-flow hijacking.\nA:H - The commit reports mm access-violation faults from the overrun, and heap corruption can oops/panic the kernel, so availability impact is High."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/realtek/rtw88/fw.c"], "versions": [{"version": "10d162b2ed395e69720926b4f8d87f1f25ca920f", "lessThan": "ec5da191bfcd5fd22b95459b623694f66c1cc10b", "status": "affected", "versionType": "git"}, {"version": "10d162b2ed395e69720926b4f8d87f1f25ca920f", "lessThan": "d95984b5580dcb8b1c0036577c52b609990a1dab", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/realtek/rtw88/fw.c"], "versions": [{"version": "5.17", "status": "affected"}, {"version": "0", "lessThan": "5.17", "status": "unaffected", "versionType": "semver"}, {"version": "5.17.2", "lessThanOrEqual": "5.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "5.17.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "5.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ec5da191bfcd5fd22b95459b623694f66c1cc10b"}, {"url": "https://git.kernel.org/stable/c/d95984b5580dcb8b1c0036577c52b609990a1dab"}], "title": "rtw88: fix memory overrun and memory leak during hw_scan", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-49231", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-01T19:46:11.936580Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-401", "description": "CWE-401 Missing Release of Memory after Effective Lifetime"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T19:47:03.648Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-49231", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-01T19:46:11.936580Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-401", "description": "CWE-401 Missing Release of Memory after Effective Lifetime"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T16:10:38.018Z"}}], "cna": {"title": "rtw88: fix memory overrun and memory leak during hw_scan", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in rtw88 local hw_scan setup (rtw_ops_hw_scan \u2192 rtw_hw_scan_update_probe_req), reached only via nl80211 TRIGGER_SCAN / mac80211 hw_scan\u2014not by processing Wi\u2011Fi frames from the air.\nAC:L - On a dual-band rtw88 device with scan-offload firmware, an attacker who can issue a scan with \u22651 SSID reliably drives num_ssids\u00d7bands probes into an undersized heap buffer; no race or external layout precondition is required.\nPR:L - NL80211_CMD_TRIGGER_SCAN uses GENL_UNS_ADMIN_PERM (CAP_NET_ADMIN in the wiphy netns user_ns). mac80211 sets WIPHY_FLAG_NETNS_OK, so when the WLAN device is in a user/net namespace that capability is available without real init-namespace root.\nUI:N - The attacker triggers the scan themselves through nl80211; no separate victim action (mount, open, click) is required.\nS:U - Impact is heap corruption and potential privilege escalation within the host kernel\u2019s security authority, not a VM escape, IOMMU bypass, or other cross-boundary break.\nC:H - The undersized kzalloc followed by memcpy of multiple probe skbs is a heap out-of-bounds write that can be leveraged for adjacent-object disclosure primitives; guidance treats such memory corruption as Confidentiality High.\nI:H - Probe request contents (SSIDs/IEs) are attacker-influenced and are memcpy\u2019d past the allocated buffer (up to ~2KB with 4 SSIDs\u00d72 bands), yielding a heap OOB write usable for corruption and control-flow hijacking.\nA:H - The commit reports mm access-violation faults from the overrun, and heap corruption can oops/panic the kernel, so availability impact is High."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "10d162b2ed395e69720926b4f8d87f1f25ca920f", "lessThan": "ec5da191bfcd5fd22b95459b623694f66c1cc10b", "versionType": "git"}, {"status": "affected", "version": "10d162b2ed395e69720926b4f8d87f1f25ca920f", "lessThan": "d95984b5580dcb8b1c0036577c52b609990a1dab", "versionType": "git"}], "programFiles": ["drivers/net/wireless/realtek/rtw88/fw.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.17"}, {"status": "unaffected", "version": "0", "lessThan": "5.17", "versionType": "semver"}, {"status": "unaffected", "version": "5.17.2", "versionType": "semver", "lessThanOrEqual": "5.17.*"}, {"status": "unaffected", "version": "5.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wireless/realtek/rtw88/fw.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ec5da191bfcd5fd22b95459b623694f66c1cc10b"}, {"url": "https://git.kernel.org/stable/c/d95984b5580dcb8b1c0036577c52b609990a1dab"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtw88: fix memory overrun and memory leak during hw_scan\n\nPreviously we allocated less memory than actual required, overwrite\nto the buffer causes the mm module to complaint and raise access\nviolation faults. Along with potential memory leaks when returned\nearly. Fix these by passing the correct size and proper deinit flow."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.17.2", "versionStartIncluding": "5.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.18", "versionStartIncluding": "5.17"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:54:25.244Z"}}}, "cveMetadata": {"cveId": "CVE-2022-49231", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:54:25.244Z", "dateReserved": "2025-02-26T01:49:39.293Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-02-26T01:55:58.139Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/realtek/rtw88/fw.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ec5da191bfcd5fd22b95459b623694f66c1cc10b", "status": "affected", "version": "10d162b2ed395e69720926b4f8d87f1f25ca920f", "versionType": "git"}, {"lessThan": "d95984b5580dcb8b1c0036577c52b609990a1dab", "status": "affected", "version": "10d162b2ed395e69720926b4f8d87f1f25ca920f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/realtek/rtw88/fw.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.17"}, {"lessThan": "5.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.17.*", "status": "unaffected", "version": "5.17.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "210C679C-CF84-44A3-8939-E629C87E54BF", "versionEndExcluding": "5.17.2", "versionStartIncluding": "5.17", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtw88: fix memory overrun and memory leak during hw_scan\n\nPreviously we allocated less memory than actual required, overwrite\nto the buffer causes the mm module to complaint and raise access\nviolation faults. Along with potential memory leaks when returned\nearly. Fix these by passing the correct size and proper deinit flow."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rtw88: se corrige el desbordamiento de memoria y la p\u00e9rdida de memoria durante hw_scan Anteriormente, asign\u00e1bamos menos memoria de la que realmente se requer\u00eda, la sobrescritura en el b\u00fafer hace que el m\u00f3dulo mm se queje y genere fallos de violaci\u00f3n de acceso. Junto con posibles p\u00e9rdidas de memoria cuando se devuelve antes. Solucione estos problemas pasando el tama\u00f1o correcto y el flujo de deinit adecuado."}], "id": "CVE-2022-49231", "lastModified": "2026-08-04T10:17:40.460", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-49231", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-01T19:46:11.936580Z", "version": "2.0.3"}}]}, "published": "2025-02-26T07:01:00.130", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d95984b5580dcb8b1c0036577c52b609990a1dab"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ec5da191bfcd5fd22b95459b623694f66c1cc10b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-401"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: rtw88: fix memory overrun and memory leak during hw_scan", "id": "2348250", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2348250"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-401", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nrtw88: fix memory overrun and memory leak during hw_scan\nPreviously we allocated less memory than actual required, overwrite\nto the buffer causes the mm module to complaint and raise access\nviolation faults. Along with potential memory leaks when returned\nearly. Fix these by passing the correct size and proper deinit flow."], "name": "CVE-2022-49231", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-02-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-49231\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-49231\nhttps://lore.kernel.org/linux-cve-announce/2025022623-CVE-2022-49231-88de@gregkh/T"], "threat_severity": "Moderate"}

{}