GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49533 (GCVE-0-2022-49533)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:13 – Updated: 2026-08-05 08:55
VLAI
Title
ath11k: Change max no of active probe SSID and BSSID to fw capability
Summary
In the Linux kernel, the following vulnerability has been resolved: ath11k: Change max no of active probe SSID and BSSID to fw capability The maximum number of SSIDs in a for active probe requests is currently reported as 16 (WLAN_SCAN_PARAMS_MAX_SSID) when registering the driver. The scan_req_params structure only has the capacity to hold 10 SSIDs. This leads to a buffer overflow which can be triggered from wpa_supplicant in userspace. When copying the SSIDs into the scan_req_params structure in the ath11k_mac_op_hw_scan route, it can overwrite the extraie pointer. Firmware supports 16 ssid * 4 bssid, for each ssid 4 bssid combo probe request will be sent, so totally 64 probe requests supported. So set both max ssid and bssid to 16 and 4 respectively. Remove the redundant macros of ssid and bssid. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01300-QCAHKSWPL_SILICONZ-1
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d5c65159f2895379e11ca13f62feabe93278985d , < 210505788f1d243232e21ef660efcd4838890ce8 (git)
Affected: d5c65159f2895379e11ca13f62feabe93278985d , < ec5dfa1d66f2f71a48dab027d26a9fa78eb0f58f (git)
Affected: d5c65159f2895379e11ca13f62feabe93278985d , < 50dc9ce9f80554a88e33b73c30851acf2be36ed3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.6
Unaffected: 0 , < 5.6 (semver)
Unaffected: 5.17.14 , ≤ 5.17.* (semver)
Unaffected: 5.18.3 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath11k/wmi.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "210505788f1d243232e21ef660efcd4838890ce8",
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "versionType": "git"
            },
            {
              "lessThan": "ec5dfa1d66f2f71a48dab027d26a9fa78eb0f58f",
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "versionType": "git"
            },
            {
              "lessThan": "50dc9ce9f80554a88e33b73c30851acf2be36ed3",
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath11k/wmi.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.14",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.3",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nath11k: Change max no of active probe SSID and BSSID to fw capability\n\nThe maximum number of SSIDs in a for active probe requests is currently\nreported as 16 (WLAN_SCAN_PARAMS_MAX_SSID) when registering the driver.\nThe scan_req_params structure only has the capacity to hold 10 SSIDs.\nThis leads to a buffer overflow which can be triggered from\nwpa_supplicant in userspace. When copying the SSIDs into the\nscan_req_params structure in the ath11k_mac_op_hw_scan route, it can\noverwrite the extraie pointer.\n\nFirmware supports 16 ssid * 4 bssid, for each ssid 4 bssid combo probe\nrequest will be sent, so totally 64 probe requests supported. So\nset both max ssid and bssid to 16 and 4 respectively. Remove the\nredundant macros of ssid and bssid.\n\nTested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01300-QCAHKSWPL_SILICONZ-1"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached via NL80211_CMD_TRIGGER_SCAN (netlink) into mac80211 drv_hw_scan \u2192 ath11k_mac_op_hw_scan; it is not triggered by received Wi\u2011Fi frames or a remote protocol.\nAC:L - An attacker who can issue a scan reliably triggers the overflow by supplying 11\u201316 SSIDs (allowed by advertised max_scan_ssids=16) with fully controlled 32-byte SSID contents; no race or unpredictable state is required.\nPR:L - TRIGGER_SCAN uses GENL_UNS_ADMIN_PERM (CAP_NET_ADMIN in the netns user_ns), which is obtainable as a low-privilege capability in common deployments (wpa_supplicant/NetworkManager, Android Wi\u2011Fi scan paths), not full root-only init-namespace admin.\nUI:N - Exploitation requires only attacker-initiated scan netlink requests with crafted SSID lists; no separate victim action is needed.\nS:U - Impact is confined to the host kernel/driver authority; there is no VM, IOMMU, or other security-boundary escape.\nC:H - Overflow of ssid[12] overwrites extraie.len/ptr with attacker-controlled bytes, and ath11k_wmi_send_scan_start_cmd then memcpy()s from that pointer, yielding an arbitrary kernel read primitive.\nI:H - This is an attacker-controlled out-of-bounds write that corrupts extraie.ptr; with a supplied IE, cleanup kfree()s the corrupted pointer (arbitrary free), enabling heap exploitation and control-flow hijacking.\nA:H - Dereferencing or freeing the corrupted extraie pointer causes kernel oops/panic, and the same path can force large/invalid allocations or crashes during WMI command build."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:55:28.982Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/210505788f1d243232e21ef660efcd4838890ce8"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec5dfa1d66f2f71a48dab027d26a9fa78eb0f58f"
        },
        {
          "url": "https://git.kernel.org/stable/c/50dc9ce9f80554a88e33b73c30851acf2be36ed3"
        }
      ],
      "title": "ath11k: Change max no of active probe SSID and BSSID to fw capability",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49533",
    "datePublished": "2025-02-26T02:13:52.495Z",
    "dateReserved": "2025-02-26T02:08:31.589Z",
    "dateUpdated": "2026-08-05T08:55:28.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49533",
      "date": "2026-09-16",
      "epss": "0.00289",
      "percentile": "0.21521"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49533\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:29.293\",\"lastModified\":\"2026-08-04T10:17:50.480\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nath11k: Change max no of active probe SSID and BSSID to fw capability\\n\\nThe maximum number of SSIDs in a for active probe requests is currently\\nreported as 16 (WLAN_SCAN_PARAMS_MAX_SSID) when registering the driver.\\nThe scan_req_params structure only has the capacity to hold 10 SSIDs.\\nThis leads to a buffer overflow which can be triggered from\\nwpa_supplicant in userspace. When copying the SSIDs into the\\nscan_req_params structure in the ath11k_mac_op_hw_scan route, it can\\noverwrite the extraie pointer.\\n\\nFirmware supports 16 ssid * 4 bssid, for each ssid 4 bssid combo probe\\nrequest will be sent, so totally 64 probe requests supported. So\\nset both max ssid and bssid to 16 and 4 respectively. Remove the\\nredundant macros of ssid and bssid.\\n\\nTested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01300-QCAHKSWPL_SILICONZ-1\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ath11k: Cambiar el n\u00famero m\u00e1ximo de SSID y BSSID de sonda activa a capacidad fw El n\u00famero m\u00e1ximo de SSID en un para solicitudes de sonda activas se informa actualmente como 16 (WLAN_SCAN_PARAMS_MAX_SSID) al registrar el controlador. La estructura scan_req_params solo tiene la capacidad de contener 10 SSID. Esto conduce a un desbordamiento de b\u00fafer que puede activarse desde wpa_supplicant en el espacio de usuario. Al copiar los SSID en la estructura scan_req_params en la ruta ath11k_mac_op_hw_scan, puede sobrescribir el puntero extraie. El firmware admite 16 ssid * 4 bssid, para cada ssid se enviar\u00e1n 4 solicitudes de sonda combinadas bssid, por lo que se admiten 64 solicitudes de sonda en total. Por lo tanto, configure tanto el ssid m\u00e1ximo como el bssid en 16 y 4 respectivamente. Elimine las macros redundantes de ssid y bssid. Probado en: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01300-QCAHKSWPL_SILICONZ-1\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/ath/ath11k/wmi.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d5c65159f2895379e11ca13f62feabe93278985d\",\"lessThan\":\"210505788f1d243232e21ef660efcd4838890ce8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d5c65159f2895379e11ca13f62feabe93278985d\",\"lessThan\":\"ec5dfa1d66f2f71a48dab027d26a9fa78eb0f58f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d5c65159f2895379e11ca13f62feabe93278985d\",\"lessThan\":\"50dc9ce9f80554a88e33b73c30851acf2be36ed3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/ath/ath11k/wmi.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.14\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.3\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.6\",\"versionEndExcluding\":\"5.17.14\",\"matchCriteriaId\":\"019AEBB8-39FD-460E-B6DE-86065EDC7F7F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"5.18.3\",\"matchCriteriaId\":\"8E122216-2E9E-4B3E-B7B8-D575A45BA3C2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/210505788f1d243232e21ef660efcd4838890ce8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/50dc9ce9f80554a88e33b73c30851acf2be36ed3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ec5dfa1d66f2f71a48dab027d26a9fa78eb0f58f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:37:41+00:00",
      "cve": "CVE-2022-49533",
      "id": "CVE-2022-49533",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ath11k: Change max no of active probe SSID and BSSID to fw capability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49533.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T01:30:27Z",
      "cve": "CVE-2022-49533",
      "id": "CVE-2022-49533",
      "initial_release_date": "2025-02-27T03:05:24Z",
      "product_status:known_affected": "425",
      "product_status:known_not_affected": "348",
      "product_status:recommended": "100",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49533",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49533.json",
      "version": "35"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.