CVE-2022-49416
Published: 26 February 2025
Summary
CVE-2022-49416 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 5.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2022-49416 is a use-after-free vulnerability in the Linux kernel's mac80211 WiFi subsystem, specifically within the channel context (chanctx) code. The issue occurs in the ieee80211_vif_use_reserved_context() function, where an old context is freed via ieee80211_vif_use_reserved_reassign() when the new context's replace_state is IEEE80211_CHANCTX_REPLACE_NONE. After freeing, the code fails to nullify the old_ctx pointer, potentially leading to subsequent access of the freed memory if the function continues execution. This flaw is classified under CWE-416 and carries a CVSS v3.1 base score of 7.8.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity (AC:L) and no user interaction required (UI:N), as it requires only local access (AV:L) in an unscoped impact scenario (S:U). Successful exploitation could result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), potentially allowing arbitrary code execution, data corruption, or system crashes within the kernel context.
Mitigation involves applying the relevant upstream kernel patches from the provided stable commit references, including 265bec4779a38b65e86a25120370f200822dfa76, 2965c4cdf7ad9ce0796fac5e57debb9519ea721e, 4ba81e794f0fad6234f644c2da1ae14d5b95e1c4, 4f05a9e15edcdf5b97e0d86ab6ecd5f187289f6c, and 6118bbdf69f4718b02d26bbcf2e497eb66004331, which fix the use-after-free by properly nullifying the old_ctx pointer and early-returning to avoid further access.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-54813
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix use-after-free in chanctx code In ieee80211_vif_use_reserved_context(), when we have an old context and the new context's replace_state is set to IEEE80211_CHANCTX_REPLACE_NONE, we free the old context in…
more
ieee80211_vif_use_reserved_reassign(). Therefore, we cannot check the old_ctx anymore, so we should set it to NULL after this point. However, since the new_ctx replace state is clearly not IEEE80211_CHANCTX_REPLACES_OTHER, we're not going to do anything else in this function and can just return to avoid accessing the freed old_ctx.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel use-after-free enabling arbitrary code execution and privilege escalation from low-privileged context.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the use-after-free vulnerability in the Linux kernel's mac80211 chanctx code by requiring timely patching with the specified upstream commits.
Implements memory safeguards such as address space randomization and non-executable memory that mitigate exploitation of the use-after-free flaw leading to arbitrary code execution.
Enforces secure kernel configuration settings, including hardening parameters like KASLR and usercopy whitelisting, to reduce the exploitability of the mac80211 chanctx use-after-free.