Executive brief
The Linux kernel's RTL8192U WiFi driver contains a use-after-free vulnerability in its packet reception function. An attacker with network access could send specially crafted wireless frames to trigger memory corruption, potentially leading to system crashes or code execution on devices running vulnerable kernel versions.
Technical details
The vulnerability is a use-after-free in the ieee80211_rx() function within the rtl8192u staging driver. The code calls ieee80211_monitor_rx() which deallocates the socket buffer (skb), then subsequently dereferences the skb pointer to access its length field. The attack vector is network-based, as it can be triggered by receiving malformed wireless frames. No authentication is required—any attacker within radio range of the WiFi adapter can exploit this. The fix (committed upstream) involves storing the skb length before the function call that frees the buffer, then using the stored value in subsequent operations. Patches are available in recent Linux kernel stable branches.
Affected products
- Linux Linux kernel Multiple versions prior to fix in commit bcc5e2dcf09089b337b76fc1a589f6ff95ca19ac
Timeline
- 2022-11-23: disclosed: Vulnerability reported and fix authored by Dan Carpenter
- 2023-01-18: patched: Patch merged into Linux kernel stable tree