CVE-2022-23088 - OpenCVE

The 802.11 beacon handling routine failed to validate the length of an IEEE 802.11s Mesh ID before copying it to a heap-allocated buffer. While a FreeBSD Wi-Fi client is in scanning mode (i.e., not associated with a SSID) a malicious beacon frame may overwrite kernel memory, leading to remote code execution.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://security.freebsd.org/advisories/FreeBSD-SA-22:07.wifi_meshid.asc

History

No history.

MITRE

Status: PUBLISHED

Assigner: freebsd

Published: 2024-02-15T05:03:38.536Z

Updated: 2024-08-03T03:28:43.494Z

Reserved: 2022-01-10T22:07:46.041Z

Link: CVE-2022-23088

Vulnrichment

Updated: 2024-08-03T03:28:43.494Z

NVD

Status : Awaiting Analysis

Published: 2024-02-15T05:15:09.440

Modified: 2024-08-01T13:42:36.930

Link: CVE-2022-23088

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-23088", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "state": "PUBLISHED", "assignerShortName": "freebsd", "dateReserved": "2022-01-10T22:07:46.041Z", "datePublished": "2024-02-15T05:03:38.536Z", "dateUpdated": "2024-08-03T03:28:43.494Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["net80211"], "product": "FreeBSD", "vendor": "FreeBSD", "versions": [{"lessThan": "p1", "status": "affected", "version": "13.1-RC1", "versionType": "release"}, {"lessThan": "p11", "status": "affected", "version": "13.0-RELEASE", "versionType": "release"}, {"lessThan": "p5", "status": "affected", "version": "12.3-RELEASE", "versionType": "release"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "m00nbsd"}, {"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Trend Micro Zero Day Initiative"}], "datePublic": "2022-04-06T05:00:00.000Z", "descriptions": [{"lang": "en", "value": "The 802.11 beacon handling routine failed to validate the length of an IEEE 802.11s Mesh ID before copying it to a heap-allocated buffer.\n\nWhile a FreeBSD Wi-Fi client is in scanning mode (i.e., not associated with a SSID) a malicious beacon frame may overwrite kernel memory, leading to remote code execution."}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2024-02-15T05:03:38.536Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-22:07.wifi_meshid.asc"}], "source": {"discovery": "UNKNOWN"}, "title": "802.11 heap buffer overflow", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "affected": [{"vendor": "freebsd", "product": "freebsd", "cpes": ["cpe:2.3:o:freebsd:freebsd:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "13.1-RC1", "status": "affected", "lessThan": "p1", "versionType": "custom"}, {"version": "13.0-release", "status": "affected", "lessThan": "p11", "versionType": "custom"}, {"version": "12.3-release", "status": "affected", "lessThan": "p5", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-02-15T16:48:56.971971Z", "id": "CVE-2022-23088", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-30T17:39:58.825Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:28:43.494Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://security.freebsd.org/advisories/FreeBSD-SA-22:07.wifi_meshid.asc"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://security.freebsd.org/advisories/FreeBSD-SA-22:07.wifi_meshid.asc", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:28:43.494Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-23088", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-02-15T16:48:56.971971Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:freebsd:freebsd:-:*:*:*:*:*:*:*"], "vendor": "freebsd", "product": "freebsd", "versions": [{"status": "affected", "version": "13.1-RC1", "lessThan": "p1", "versionType": "custom"}, {"status": "affected", "version": "13.0-release", "lessThan": "p11", "versionType": "custom"}, {"status": "affected", "version": "12.3-release", "lessThan": "p5", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-30T17:38:52.968Z"}}], "cna": {"title": "802.11 heap buffer overflow", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "m00nbsd"}, {"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Trend Micro Zero Day Initiative"}], "affected": [{"vendor": "FreeBSD", "modules": ["net80211"], "product": "FreeBSD", "versions": [{"status": "affected", "version": "13.1-RC1", "lessThan": "p1", "versionType": "release"}, {"status": "affected", "version": "13.0-RELEASE", "lessThan": "p11", "versionType": "release"}, {"status": "affected", "version": "12.3-RELEASE", "lessThan": "p5", "versionType": "release"}], "defaultStatus": "unknown"}], "datePublic": "2022-04-06T05:00:00.000Z", "references": [{"url": "https://security.freebsd.org/advisories/FreeBSD-SA-22:07.wifi_meshid.asc", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "The 802.11 beacon handling routine failed to validate the length of an IEEE 802.11s Mesh ID before copying it to a heap-allocated buffer.\n\nWhile a FreeBSD Wi-Fi client is in scanning mode (i.e., not associated with a SSID) a malicious beacon frame may overwrite kernel memory, leading to remote code execution."}], "providerMetadata": {"orgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "shortName": "freebsd", "dateUpdated": "2024-02-15T05:03:38.536Z"}}}, "cveMetadata": {"cveId": "CVE-2022-23088", "state": "PUBLISHED", "dateUpdated": "2024-08-03T03:28:43.494Z", "dateReserved": "2022-01-10T22:07:46.041Z", "assignerOrgId": "63664ac6-956c-4cba-a5d0-f46076e16109", "datePublished": "2024-02-15T05:03:38.536Z", "assignerShortName": "freebsd"}, "dataVersion": "5.1"}