CVE-2022-42719: Linux Kernel Use-After-Free Vulnerability

CVE-2022-42719 Overview

CVE-2022-42719 is a use-after-free vulnerability in the mac80211 stack of the Linux kernel affecting versions 5.2 through 5.19.x before 5.19.16. The vulnerability occurs when parsing a multi-BSSID element in wireless frames. Attackers capable of injecting WLAN frames can exploit this flaw to crash the kernel and potentially achieve arbitrary code execution, making this a significant threat to systems with wireless networking enabled.

Critical Impact

This use-after-free vulnerability in the Linux kernel's wireless stack allows attackers within adjacent network range to potentially execute arbitrary code at the kernel level, leading to complete system compromise.

Affected Products

• Linux Kernel versions 5.2 through 5.19.x (before 5.19.16)
• Fedora 35, 36, and 37
• Debian Linux 10.0 and 11.0

Discovery Timeline

• October 13, 2022 - CVE-2022-42719 published to NVD
• May 15, 2025 - Last updated in NVD database

Technical Details for CVE-2022-42719

Vulnerability Analysis

The vulnerability resides in the mac80211 wireless stack, specifically in the code responsible for parsing multi-BSSID elements within 802.11 management frames. Multi-BSSID is a feature that allows access points to advertise multiple virtual BSSIDs within a single beacon frame, improving network efficiency and scalability.

The use-after-free condition occurs due to improper memory management when processing these multi-BSSID elements. When the kernel parses a maliciously crafted WLAN frame containing a multi-BSSID element, it may reference memory that has already been freed, leading to undefined behavior. This can result in kernel crashes (denial of service) or, in more sophisticated attacks, arbitrary code execution with kernel privileges.

The vulnerability is classified as CWE-416 (Use After Free), a common memory corruption flaw where a program continues to use a pointer after the memory it points to has been freed and potentially reallocated for other purposes.

Root Cause

The root cause of CVE-2022-42719 lies in the improper handling of memory lifecycle management within the multi-BSSID parsing routines of the mac80211 stack. When processing incoming wireless frames, the kernel allocates memory structures to hold parsed BSSID information. Under certain conditions, the code path responsible for cleanup may free these structures prematurely while other parts of the code still hold references to them.

When these stale references are subsequently dereferenced, the kernel accesses memory that may have been reallocated for other purposes, corrupted, or marked as invalid. The commit ff05d4b45dd89b922578dac497dcabf57cf771c6 in the kernel wireless git repository addresses this by implementing proper reference counting and ensuring memory is not freed while still in use.

Attack Vector

The attack vector for CVE-2022-42719 requires adjacent network access, meaning the attacker must be within wireless range of the target system. The attack does not require authentication or user interaction, making it particularly dangerous in environments with wireless networking enabled.

An attacker would craft malicious 802.11 management frames containing specially constructed multi-BSSID elements designed to trigger the use-after-free condition. These frames can be injected using commodity wireless hardware in monitor mode. The vulnerability mechanism involves the parsing code accessing freed memory structures when processing these malicious frames, potentially allowing the attacker to control the contents of the reallocated memory region and achieve code execution in kernel context.

Detection Methods for CVE-2022-42719

Indicators of Compromise

• Unexpected kernel panics or system crashes, particularly on systems with active wireless interfaces
• Kernel log messages indicating memory corruption or invalid memory access in mac80211 or wireless-related modules
• Unusual wireless deauthentication or disassociation events preceding system instability
• Memory corruption signatures in crash dumps pointing to ieee80211_ or cfg80211_ function prefixes

Detection Strategies

• Deploy kernel-level monitoring to detect anomalous memory access patterns in the mac80211 stack
• Monitor system logs for kernel oops or panic messages referencing wireless subsystem functions
• Implement wireless intrusion detection systems (WIDS) to identify malformed or anomalous 802.11 management frames
• Use SentinelOne's kernel-level behavioral analysis to detect exploitation attempts targeting memory corruption vulnerabilities

Monitoring Recommendations

• Enable kernel logging with enhanced verbosity for wireless subsystem events
• Configure alerting on sudden wireless interface disconnections followed by kernel-level errors
• Monitor for signs of post-exploitation activity such as unauthorized privilege escalation or persistence mechanisms
• Implement network-level monitoring for unusual wireless frame patterns in proximity to affected systems

How to Mitigate CVE-2022-42719

Immediate Actions Required

• Update Linux kernel to version 5.19.16 or later immediately on all affected systems
• If immediate patching is not possible, consider disabling wireless interfaces on critical systems until updates can be applied
• Review and apply distribution-specific security updates from Debian and Fedora
• Ensure SentinelOne agents are deployed and updated to provide runtime protection against exploitation attempts

Patch Information

The vulnerability has been patched in Linux kernel version 5.19.16 and subsequent releases. The fix is documented in the kernel wireless git commit. Distribution-specific patches are available through the following advisories:

• Debian Security Advisory DSA-5257
• Debian LTS Announcement
• Fedora Package Announcements
• Kernel Live Patch Security Notice LNS-0091-1

Workarounds

• Disable wireless networking on systems where it is not essential until patches can be applied
• Use rfkill to software-block wireless interfaces: rfkill block wifi
• Implement network segmentation to limit exposure of vulnerable systems to untrusted wireless environments
• Consider using wired network connections as an alternative on critical infrastructure

# Disable wireless interface temporarily as a mitigation
sudo rfkill block wifi

# Verify wireless is disabled
rfkill list

# Check current kernel version
uname -r

# Update kernel on Debian-based systems
sudo apt update && sudo apt upgrade linux-image-$(uname -r)

# Update kernel on Fedora
sudo dnf update kernel