#VU104511 Out-of-bounds read in Linux kernel - CVE-2022-49503

Vulnerability identifier: #VU104511

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49503

CWE-ID: CWE-125

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the ath9k_rx_prepare() function in drivers/net/wireless/ath/ath9k/htc_drv_txrx.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/0bcb528402cd5e1a6e1833e956fd58a12d509e8e
https://git.kernel.org/stable/c/2326d398ccd41ba6d93b8346532dfa432ab00fee
https://git.kernel.org/stable/c/2dc509305cf956381532792cb8dceef2b1504765
https://git.kernel.org/stable/c/3dad3fed5672828c7fb0465cb66a3d9a70952fa6
https://git.kernel.org/stable/c/461e4c1f199076275f16bf6f3d3e42c6b6c79f33
https://git.kernel.org/stable/c/4bdcf32c965c27f55ccc4ee71c1927131115b0bb
https://git.kernel.org/stable/c/7f6defe0fabc79f29603c6fa3c80e4fe0456a3e9
https://git.kernel.org/stable/c/a048e0c3caa852397b7b50d4c82a0415c05f7ac3
https://git.kernel.org/stable/c/eda518db7db16c360bc84379d90675650daa3048

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.