CVE-2022-50164

EUVD-2022-55429
In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue

After successfull station association, if station queues are disabled for
some reason, the related lists are not emptied. So if some new element is
added to the list in iwl_mvm_mac_wake_tx_queue, it can match with the old
one and produce a BUG like this:

[   46.535263] list_add corruption. prev->next should be next (ffff94c1c318a360), but was 0000000000000000. (prev=ffff94c1d02d3388).
[   46.535283] ------------[ cut here ]------------
[   46.535284] kernel BUG at lib/list_debug.c:26!
[   46.535290] invalid opcode: 0000 [#1] PREEMPT SMP PTI
[   46.585304] CPU: 0 PID: 623 Comm: wpa_supplicant Not tainted 5.19.0-rc3+ #1
[   46.592380] Hardware name: Dell Inc. Inspiron 660s/0478VN       , BIOS A07 08/24/2012
[   46.600336] RIP: 0010:__list_add_valid.cold+0x3d/0x3f
[   46.605475] Code: f2 4c 89 c1 48 89 fe 48 c7 c7 c8 40 67 93 e8 20 cc fd ff 0f 0b 48 89 d1 4c 89 c6 4c 89 ca 48 c7 c7 70 40 67 93 e8 09 cc fd ff <0f> 0b 48 89 fe 48 c7 c7 00 41 67 93 e8 f8 cb fd ff 0f 0b 48 89 d1
[   46.624469] RSP: 0018:ffffb20800ab76d8 EFLAGS: 00010286
[   46.629854] RAX: 0000000000000075 RBX: ffff94c1c318a0e0 RCX: 0000000000000000
[   46.637105] RDX: 0000000000000201 RSI: ffffffff9365e100 RDI: 00000000ffffffff
[   46.644356] RBP: ffff94c1c5f43370 R08: 0000000000000075 R09: 3064316334396666
[   46.651607] R10: 3364323064316334 R11: 39666666663d7665 R12: ffff94c1c5f43388
[   46.658857] R13: ffff94c1d02d3388 R14: ffff94c1c318a360 R15: ffff94c1cf2289c0
[   46.666108] FS:  00007f65634ff7c0(0000) GS:ffff94c1da200000(0000) knlGS:0000000000000000
[   46.674331] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   46.680170] CR2: 00007f7dfe984460 CR3: 000000010e894003 CR4: 00000000000606f0
[   46.687422] Call Trace:
[   46.689906]  <TASK>
[   46.691950]  iwl_mvm_mac_wake_tx_queue+0xec/0x15c [iwlmvm]
[   46.697601]  ieee80211_queue_skb+0x4b3/0x720 [mac80211]
[   46.702973]  ? sta_info_get+0x46/0x60 [mac80211]
[   46.707703]  ieee80211_tx+0xad/0x110 [mac80211]
[   46.712355]  __ieee80211_tx_skb_tid_band+0x71/0x90 [mac80211]
...

In order to avoid this problem, we must also remove the related lists when
station queues are disabled.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 3%
Affected Products (NVD)
VendorProductVersion
linuxlinux_kernel
5.1 ≤
𝑥
< 5.4.211
linuxlinux_kernel
5.5 ≤
𝑥
< 5.10.137
linuxlinux_kernel
5.11 ≤
𝑥
< 5.15.61
linuxlinux_kernel
5.16 ≤
𝑥
< 5.18.18
linuxlinux_kernel
5.19 ≤
𝑥
< 5.19.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
linux
bookworm
6.1.137-1
fixed
bookworm (security)
6.1.140-1
fixed
bullseye
5.10.223-1
fixed
bullseye (security)
5.10.237-1
fixed
sid
6.12.32-1
fixed
trixie
6.12.32-1
fixed
trixie (security)
6.12.31-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
linux
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
needs-triage
plucky
needs-triage
trusty
needs-triage
xenial
needs-triage
linux-allwinner-5.19
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-aws
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
needs-triage
plucky
needs-triage
trusty
needs-triage
xenial
needs-triage
linux-aws-5.0
bionic
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-aws-5.11
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-aws-5.13
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-aws-5.15
focal
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-aws-5.19
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-aws-5.3
bionic
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-aws-5.4
bionic
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-aws-5.8
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-aws-6.2
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-aws-6.5
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-aws-6.8
jammy
needs-triage
noble
dne
oracular
dne
plucky
dne
linux-aws-fips
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
dne
oracular
dne
plucky
dne
linux-aws-hwe
jammy
dne
noble
dne
oracular
dne
plucky
dne
xenial
needs-triage
linux-azure
bionic
ignored
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
needs-triage
plucky
needs-triage
trusty
needs-triage
xenial
needs-triage
linux-azure-4.15
bionic
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-azure-5.11
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-azure-5.13
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-azure-5.15
focal
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-azure-5.19
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-azure-5.3
bionic
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-azure-5.4
bionic
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-azure-5.8
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-azure-6.11
jammy
dne
noble
needs-triage
oracular
dne
plucky
dne
linux-azure-6.2
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-azure-6.5
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-azure-6.8
jammy
needs-triage
noble
dne
oracular
dne
plucky
dne
linux-azure-edge
bionic
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-azure-fde
focal
ignored
jammy
needs-triage
noble
dne
oracular
dne
plucky
dne
linux-azure-fde-5.15
focal
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-azure-fde-5.19
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-azure-fde-6.2
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-azure-fips
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
dne
oracular
dne
plucky
dne
linux-azure-nvidia
jammy
dne
noble
needs-triage
oracular
dne
plucky
dne
linux-bluefield
focal
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-fips
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
dne
oracular
dne
plucky
dne
xenial
needs-triage
linux-gcp
bionic
ignored
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
needs-triage
plucky
needs-triage
xenial
needs-triage
linux-gcp-4.15
bionic
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-gcp-5.11
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-gcp-5.13
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-gcp-5.15
focal
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-gcp-5.19
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-gcp-5.3
bionic
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-gcp-5.4
bionic
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-gcp-5.8
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-gcp-6.11
jammy
dne
noble
needs-triage
oracular
dne
plucky
dne
linux-gcp-6.2
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-gcp-6.5
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-gcp-6.8
jammy
needs-triage
noble
dne
oracular
dne
plucky
dne
linux-gcp-fips
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
dne
oracular
dne
plucky
dne
linux-gke
focal
ignored
jammy
needs-triage
noble
needs-triage
oracular
dne
plucky
dne
linux-gke-4.15
bionic
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-gke-5.15
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-gke-5.4
bionic
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-gkeop
focal
ignored
jammy
needs-triage
noble
needs-triage
oracular
dne
plucky
dne
linux-gkeop-5.15
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-gkeop-5.4
bionic
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-hwe
bionic
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
xenial
needs-triage
linux-hwe-5.11
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-hwe-5.13
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-hwe-5.15
focal
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-hwe-5.19
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-hwe-5.4
bionic
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-hwe-5.8
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-hwe-6.11
jammy
dne
noble
needs-triage
oracular
dne
plucky
dne
linux-hwe-6.2
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-hwe-6.5
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-hwe-6.8
jammy
needs-triage
noble
dne
oracular
dne
plucky
dne
linux-hwe-edge
bionic
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
xenial
ignored
linux-ibm
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
dne
plucky
dne
linux-ibm-5.15
focal
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-ibm-5.4
bionic
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-intel-5.13
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-intel-iot-realtime
jammy
needs-triage
noble
dne
oracular
dne
plucky
dne
linux-intel-iotg
jammy
needs-triage
noble
dne
oracular
dne
plucky
dne
linux-intel-iotg-5.15
focal
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-iot
focal
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-kvm
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
dne
oracular
dne
plucky
dne
xenial
needs-triage
linux-lowlatency
jammy
needs-triage
noble
needs-triage
oracular
needs-triage
plucky
dne
linux-lowlatency-hwe-5.15
focal
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-lowlatency-hwe-5.19
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-lowlatency-hwe-6.11
jammy
dne
noble
needs-triage
oracular
dne
plucky
dne
linux-lowlatency-hwe-6.2
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-lowlatency-hwe-6.5
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-lowlatency-hwe-6.8
jammy
needs-triage
noble
dne
oracular
dne
plucky
dne
linux-lts-xenial
jammy
dne
noble
dne
oracular
dne
plucky
dne
trusty
needs-triage
linux-nvidia
jammy
needs-triage
noble
needs-triage
oracular
dne
plucky
dne
linux-nvidia-6.2
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-nvidia-6.5
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-nvidia-6.8
jammy
needs-triage
noble
dne
oracular
dne
plucky
dne
linux-nvidia-lowlatency
jammy
dne
noble
needs-triage
oracular
dne
plucky
dne
linux-nvidia-tegra
jammy
needs-triage
noble
needs-triage
oracular
dne
plucky
dne
linux-nvidia-tegra-5.15
focal
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-nvidia-tegra-igx
jammy
needs-triage
noble
dne
oracular
dne
plucky
dne
linux-oem
bionic
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-oem-5.10
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-oem-5.13
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-oem-5.14
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-oem-5.17
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-oem-5.6
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-oem-6.0
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-oem-6.1
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-oem-6.11
jammy
dne
noble
needs-triage
oracular
dne
plucky
dne
linux-oem-6.14
jammy
dne
noble
needs-triage
oracular
dne
plucky
dne
linux-oem-6.5
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-oem-6.8
jammy
dne
noble
needs-triage
oracular
dne
plucky
dne
linux-oracle
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
needs-triage
plucky
needs-triage
xenial
needs-triage
linux-oracle-5.0
bionic
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-oracle-5.11
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-oracle-5.13
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-oracle-5.15
focal
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-oracle-5.3
bionic
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-oracle-5.4
bionic
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-oracle-5.8
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-oracle-6.5
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-oracle-6.8
jammy
needs-triage
noble
dne
oracular
dne
plucky
dne
linux-raspi
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
needs-triage
plucky
needs-triage
linux-raspi-5.4
bionic
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-raspi-realtime
jammy
dne
noble
needs-triage
oracular
dne
plucky
dne
linux-raspi2
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-realtime
jammy
needs-triage
noble
needs-triage
oracular
needs-triage
plucky
needs-triage
linux-riscv
focal
ignored
jammy
ignored
noble
needs-triage
oracular
needs-triage
plucky
needs-triage
linux-riscv-5.11
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-riscv-5.15
focal
needs-triage
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-riscv-5.19
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-riscv-5.8
focal
ignored
jammy
dne
noble
dne
oracular
dne
plucky
dne
linux-riscv-6.5
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-riscv-6.8
jammy
needs-triage
noble
dne
oracular
dne
plucky
dne
linux-starfive-5.19
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-starfive-6.2
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-starfive-6.5
jammy
ignored
noble
dne
oracular
dne
plucky
dne
linux-xilinx-zynqmp
focal
needs-triage
jammy
needs-triage
noble
dne
oracular
dne
plucky
dne