by Kastro
Paper/Archive/CVE-2022-23088

CVE-2022-23088

FreeBSD FreeBSD — 802.11 heap buffer overflow

EPSS 4%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 89.5.895 × 2017.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The 802.11 beacon handling routine failed to validate the length of an IEEE 802.11s Mesh ID before copying it to a heap-allocated buffer. While a FreeBSD Wi-Fi client is in scanning mode (i.e., not associated with a SSID) a malicious beacon frame may overwrite kernel memory, leading to remote code execution.

Affected

ProductAffectedFixed inSource
FreeBSD13.1-RC1 – < p1p1CNA
FreeBSD13.0-RELEASE – < p11p11CNA
FreeBSD12.3-RELEASE – < p5p5CNA
freebsd13.1-RC1 – < p1p1CISA-ADP
freebsd13.0-release – < p11p11CISA-ADP
freebsd12.3-release – < p5p5CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorysecurity.freebsd.org/advisories/FreeBSD-SA-22:07.wifi_meshid.asc