CVE-2022-49479
📋 TL;DR
This is a use-after-free vulnerability in the Linux kernel's mt76 wireless driver that occurs during station removal. It allows attackers with local access to potentially cause kernel crashes or execute arbitrary code. Systems using affected mt76 wireless drivers are vulnerable.
💻 Affected Systems
- Linux kernel with mt76 wireless driver
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise via kernel code execution
Likely Case
Kernel panic or system crash causing denial of service
If Mitigated
Limited to denial of service if kernel hardening features are enabled
🎯 Exploit Status
Requires local access and knowledge of wireless station management
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel with commits ddd426d72aca, ef7f9f894cfd, or fcfe1b5e162b
Vendor Advisory: https://git.kernel.org/stable/c/ddd426d72aca4054045a9bd3b80a4ce1d398f11f
Restart Required: No
Instructions:
1. Update Linux kernel to version containing the fix commits
2. Rebuild kernel if using custom kernel
3. Load updated kernel module
🔧 Temporary Workarounds
Disable mt76 driver
allRemove or blacklist the vulnerable mt76 kernel module
echo 'blacklist mt76' >> /etc/modprobe.d/blacklist-mt76.conf
rmmod mt76
🧯 If You Can't Patch
- Restrict local user access to systems with vulnerable drivers
- Implement kernel hardening features like KASLR and SMEP/SMAP
🔍 How to Verify
Check if Vulnerable:
Check if mt76 module is loaded: lsmod | grep mt76Check Version:
uname -rVerify Fix Applied:
Check kernel version includes fix commits: uname -r and verify with git log📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- Oops messages in dmesg
- System crashes
Network Indicators:
- Unusual wireless station disconnections
SIEM Query:
search 'kernel panic' OR 'Oops' OR 'general protection fault' in system logs