CVE-2022-49479
Published: 26 February 2025
Summary
CVE-2022-49479 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 29.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2022-49479 is a use-after-free vulnerability in the Linux kernel's mt76 driver, which handles MediaTek WiFi chipsets. The issue arises from a race condition during station removal, where ongoing transmit (tx) activity can add a socket buffer (skb) to the status tracking IDR after the IDR has been cleaned up. This leaves the wireless client ID (wcid) linked in the status poll list, potentially leading to memory corruption. The vulnerability is rated with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-416 (Use After Free).
A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of user interaction requirements. Successful exploitation could result in high impacts on confidentiality, integrity, and availability, such as arbitrary code execution or denial of service within the kernel context of the affected WiFi driver.
Mitigation involves applying the upstream kernel patches referenced in the stable repository commits. These fixes ensure that status skbs are only added to the tracking if the wcid pointer remains assigned in dev->wcid, which is cleared early by mt76_sta_pre_rcu_remove, closing the race window. Security practitioners should update affected Linux kernels to versions incorporating these commits: ddd426d72aca4054045a9bd3b80a4ce1d398f11f, ef7f9f894cfd0b2e471206409a529af4a26ddd55, and fcfe1b5e162bf473c1d47760962cec8523c00466.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-54750
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: mt76: fix tx status related use-after-free race on station removal There is a small race window where ongoing tx activity can lead to a skb getting added to the status…
more
tracking idr after that idr has already been cleaned up, which will keep the wcid linked in the status poll list. Fix this by only adding status skbs if the wcid pointer is still assigned in dev->wcid, which gets cleared early by mt76_sta_pre_rcu_remove
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel use-after-free in WiFi driver directly enables privilege escalation via arbitrary code execution in kernel context (AV:L, PR:L).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely patching of the use-after-free race condition in the Linux kernel's mt76 WiFi driver as specified in the CVE remediation commits.
Implements kernel memory protections such as address space randomization and non-executable memory to mitigate exploitation of the use-after-free leading to corruption.
Ensures secure kernel configuration settings, including mitigations like hardened slab allocators and updated driver parameters to reduce the race window impact.