{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-48787", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-16T11:38:08.891Z", "datePublished": "2024-07-16T11:43:44.349Z", "dateUpdated": "2026-08-05T08:52:17.446Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:52:17.446Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niwlwifi: fix use-after-free\n\nIf no firmware was present at all (or, presumably, all of the\nfirmware files failed to parse), we end up unbinding by calling\ndevice_release_driver(), which calls remove(), which then in\niwlwifi calls iwl_drv_stop(), freeing the 'drv' struct. However\nthe new code I added will still erroneously access it after it\nwas freed.\n\nSet 'failure=false' in this case to avoid the access, all data\nwas already freed anyway." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The UAF is in the iwlwifi firmware-request callback during PCI probe/unbind, reached via local driver initialization and request_firmware_nowait—not via WiFi frame processing or any network-facing path.\nAC:L - Once the failure/unbind path runs, the UAF is deterministic (device_release_driver frees drv, then iwl_dealloc_ucode uses it); no attacker-uncontrollable race is required to hit the bug.\nPR:L - A local unprivileged user on a system with Intel WiFi can be present when the driver probes with missing or unparseable firmware (common deployment failure mode), which is sufficient to reach the vulnerable path without needing real root beyond basic local access.\nUI:N - Firmware load and the subsequent unbind/UAF occur automatically in the async firmware callback during driver probe; no separate victim user action is required.\nS:U - This is a standard in-kernel UAF in the WiFi driver affecting the host kernel's own memory authority, with no VM escape, IOMMU bypass, or other cross-boundary impact.\nC:H - Use-after-free of struct iwl_drv lets an attacker reclaim the object and control fields later read as pointers, enabling disclosure of kernel memory contents.\nI:H - iwl_dealloc_ucode() performs multiple kfree() calls and a memset on the freed drv->fw state, yielding arbitrary-free and memory-corruption primitives suitable for control-flow hijacking.\nA:H - Dereferencing and freeing poisoned/reused slab contents reliably causes kernel oops/panic, as confirmed by multiple real-world crash reports that motivated the fix." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/intel/iwlwifi/iwl-drv.c" ], "versions": [ { "version": "8e10749fa1a454c1e7214f36cec83241f5a36ef1", "lessThan": "d3b98fe36f8a06ce654049540773256ab59cb53d", "status": "affected", "versionType": "git" }, { "version": "1d7cc54137a4f28506dc7beac235b240b08f4e59", "lessThan": "7d6475179b85a83186ccce59cdc359d4f07d0bcb", "status": "affected", "versionType": "git" }, { "version": "0446cafa843e6db4982731c167e11c80d42be7e2", "lessThan": "494de920d98f125b099f27a2d274850750aff957", "status": "affected", "versionType": "git" }, { "version": "febab6b60d61d13cd9f30a2991deea56df39567d", "lessThan": "008508c16af0087cda0394e1ac6f0493b01b6063", "status": "affected", "versionType": "git" }, { "version": "e23f075d77987de4215c8e0696f28bcc707506f7", "lessThan": "ddd46059f7d99119b62d44c519df7a79f2e6a515", "status": "affected", "versionType": "git" }, { "version": "6b5ad4bd0d78fef6bbe0ecdf96e09237c9c52cc1", "lessThan": "9958b9cbb22145295ee1ffaea0904c383da2c05d", "status": "affected", "versionType": "git" }, { "version": "ab07506b0454bea606095951e19e72c282bfbb42", "lessThan": "bea2662e7818e15d7607d17d57912ac984275d94", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/intel/iwlwifi/iwl-drv.c" ], "versions": [ { "version": "4.14.263", "lessThan": "4.14.268", "status": "affected", "versionType": "semver" }, { "version": "4.19.226", "lessThan": "4.19.231", "status": "affected", "versionType": "semver" }, { "version": "5.4.174", "lessThan": "5.4.181", "status": "affected", "versionType": "semver" }, { "version": "5.10.94", "lessThan": "5.10.102", "status": "affected", "versionType": "semver" }, { "version": "5.15.17", "lessThan": "5.15.25", "status": "affected", "versionType": "semver" }, { "version": "5.16.3", "lessThan": "5.16.11", "status": "affected", "versionType": "semver" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.263", "versionEndExcluding": "4.14.268" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.226", "versionEndExcluding": "4.19.231" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.174", "versionEndExcluding": "5.4.181" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.94", "versionEndExcluding": "5.10.102" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.17", "versionEndExcluding": "5.15.25" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16.3", "versionEndExcluding": "5.16.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/d3b98fe36f8a06ce654049540773256ab59cb53d" }, { "url": "https://git.kernel.org/stable/c/7d6475179b85a83186ccce59cdc359d4f07d0bcb" }, { "url": "https://git.kernel.org/stable/c/494de920d98f125b099f27a2d274850750aff957" }, { "url": "https://git.kernel.org/stable/c/008508c16af0087cda0394e1ac6f0493b01b6063" }, { "url": "https://git.kernel.org/stable/c/ddd46059f7d99119b62d44c519df7a79f2e6a515" }, { "url": "https://git.kernel.org/stable/c/9958b9cbb22145295ee1ffaea0904c383da2c05d" }, { "url": "https://git.kernel.org/stable/c/bea2662e7818e15d7607d17d57912ac984275d94" } ], "title": "iwlwifi: fix use-after-free", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:25:01.764Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/d3b98fe36f8a06ce654049540773256ab59cb53d", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/7d6475179b85a83186ccce59cdc359d4f07d0bcb", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/494de920d98f125b099f27a2d274850750aff957", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/008508c16af0087cda0394e1ac6f0493b01b6063", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/ddd46059f7d99119b62d44c519df7a79f2e6a515", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/9958b9cbb22145295ee1ffaea0904c383da2c05d", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/bea2662e7818e15d7607d17d57912ac984275d94", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2022-48787", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:59:49.027467Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:16.166Z" } } ] } }