CVE-2022-49305

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49305
In the Linux kernel, the following vulnerability has been resolved: drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() There is a deadlock in ieee80211_beacons_stop(), which is shown below: (Thread 1) | (Thread 2) | ieee80211_send_beacon() ieee80211_beacons_stop() | mod_timer() spin_lock_irqsave() //(1) | (wait a time) ... | ieee80211_send_beacon_cb() del_timer_sync() | spin_lock_irqsave() //(2) (wait timer to stop) | ... We hold ieee->beacon_lock in position (1) of thread 1 and use del_timer_sync() to wait timer to stop, but timer handler also need ieee->beacon_lock in position (2) of thread 2. As a result, ieee80211_beacons_stop() will block forever. This patch extracts del_timer_sync() from the protection of spin_lock_irqsave(), which could let timer handler to obtain the needed lock.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/042915c1bfedd684c1d98a841794ee203200571a Patch
https://git.kernel.org/stable/c/1fbe033c52480f7954c057510040fa6286c4ea25 Patch
https://git.kernel.org/stable/c/66f769762f65d957f688f3258755c6ec410bf710 Patch
https://git.kernel.org/stable/c/806c7b53414934ba2a39449b31fd1a038e500273 Patch
https://git.kernel.org/stable/c/b34cb54923a6e5ddefbaf358c85c922c6ab456e2 Patch
https://git.kernel.org/stable/c/b465bb2ebf666116c1ac745cb80c65154dc0d27e Patch
https://git.kernel.org/stable/c/ffc9cab7243f8151be37966301307bfd3cda2db3 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

14 Apr 2025, 20:06

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/042915c1bfedd684c1d98a841794ee203200571a - () https://git.kernel.org/stable/c/042915c1bfedd684c1d98a841794ee203200571a - Patch
References () https://git.kernel.org/stable/c/1fbe033c52480f7954c057510040fa6286c4ea25 - () https://git.kernel.org/stable/c/1fbe033c52480f7954c057510040fa6286c4ea25 - Patch
References () https://git.kernel.org/stable/c/66f769762f65d957f688f3258755c6ec410bf710 - () https://git.kernel.org/stable/c/66f769762f65d957f688f3258755c6ec410bf710 - Patch
References () https://git.kernel.org/stable/c/806c7b53414934ba2a39449b31fd1a038e500273 - () https://git.kernel.org/stable/c/806c7b53414934ba2a39449b31fd1a038e500273 - Patch
References () https://git.kernel.org/stable/c/b34cb54923a6e5ddefbaf358c85c922c6ab456e2 - () https://git.kernel.org/stable/c/b34cb54923a6e5ddefbaf358c85c922c6ab456e2 - Patch
References () https://git.kernel.org/stable/c/b465bb2ebf666116c1ac745cb80c65154dc0d27e - () https://git.kernel.org/stable/c/b465bb2ebf666116c1ac745cb80c65154dc0d27e - Patch
References () https://git.kernel.org/stable/c/ffc9cab7243f8151be37966301307bfd3cda2db3 - () https://git.kernel.org/stable/c/ffc9cab7243f8151be37966301307bfd3cda2db3 - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drivers: staging: rtl8192u: Corregir bloqueo en ieee80211_beacons_stop() Hay un bloqueo en ieee80211_beacons_stop(), que se muestra a continuación: (Hilo 1) | (Hilo 2) | ieee80211_send_beacon() ieee80211_beacons_stop() | mod_timer() spin_lock_irqsave() //(1) | (esperar un tiempo) ... | ieee80211_send_beacon_cb() del_timer_sync() | spin_lock_irqsave() //(2) (esperar a que el temporizador se detenga) | ... Mantenemos ieee->beacon_lock en la posición (1) del hilo 1 y usamos del_timer_sync() para esperar a que el temporizador se detenga, pero el controlador del temporizador también necesita ieee->beacon_lock en la posición (2) del hilo 2. Como resultado, ieee80211_beacons_stop() se bloqueará para siempre. Este parche extrae del_timer_sync() de la protección de spin_lock_irqsave(), lo que podría permitir que el controlador del temporizador obtenga el bloqueo necesario.
CWE CWE-667

26 Feb 2025, 07:01

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-26 07:01

Updated : 2025-04-14 20:06

NVD link : CVE-2022-49305

Mitre link : CVE-2022-49305

CVE.ORG link : CVE-2022-49305

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-667

Improper Locking