{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-49405","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-02-26T02:08:31.566Z","datePublished":"2025-02-26T02:12:30.617Z","dateUpdated":"2026-08-05T08:55:02.085Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T08:55:02.085Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: r8188eu: prevent ->Ssid overflow in rtw_wx_set_scan()\n\nThis code has a check to prevent read overflow but it needs another\ncheck to prevent writing beyond the end of the ->Ssid[] array."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The overflow is reached only via local wireless-extensions ioctls (SIOCSIWSCAN or SIOCSIWPRIV→rtw_wx_set_priv) that deliver an attacker-crafted CSCAN buffer into rtw_wx_set_scan(); no received WiFi frame or remote peer path invokes this parser.\nAC:L - The attacker fully controls the CSCAN section type, sec_len, and payload in a single ioctl, and the missing Ssid[32] bound check makes the stack overflow deterministic with no race or attacker-uncontrollable condition.\nPR:L - wext_permission_check() requires capable(CAP_NET_ADMIN), a capability routinely held by non-root WiFi management daemons (wpa_supplicant/NetworkManager) on the phones and embedded devices this USB RTL8188EU driver targets, and this CNA consistently scores CAP_NET_ADMIN-gated WEXT bugs as PR:L.\nUI:N - The attacker issues the ioctl directly against an already-registered r8188eu interface; no victim action such as mounting media or opening a crafted file is required.\nS:U - The stack overflow corrupts kernel stack/memory within the same host kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Attacker-controlled out-of-bounds stack writes (and unbounded ssid_index growth past RTW_SSID_SCAN_AMOUNT) are memory-corruption primitives that can be leveraged for arbitrary kernel memory disclosure under standard stack-smash exploitation.\nI:H - This is a classic stack buffer overflow of Ssid[32] with attacker-chosen length and contents, enabling overwrite of adjacent stack state and return addresses for arbitrary write / control-flow hijack.\nA:H - Corrupting the on-stack ssid[RTW_SSID_SCAN_AMOUNT] array and frames beyond it reliably produces kernel oops/panic even without full code-execution exploitation."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/staging/r8188eu/os_dep/ioctl_linux.c"],"versions":[{"version":"2b42bd58b32155a1be4dd78991845dec05aaef9e","lessThan":"ac2eab7de458f5e1210ce1237afab40a307075c8","status":"affected","versionType":"git"},{"version":"2b42bd58b32155a1be4dd78991845dec05aaef9e","lessThan":"c4bd6b72df4f01aa866ceb298466d6d07a6bd525","status":"affected","versionType":"git"},{"version":"2b42bd58b32155a1be4dd78991845dec05aaef9e","lessThan":"476bfda0be0f9669add92bff604ca78226cf53d1","status":"affected","versionType":"git"},{"version":"2b42bd58b32155a1be4dd78991845dec05aaef9e","lessThan":"bc10916e890948d8927a5c8c40fb5dc44be5e1b8","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/staging/r8188eu/os_dep/ioctl_linux.c"],"versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","status":"unaffected","versionType":"semver"},{"version":"5.15.46","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"5.17.14","lessThanOrEqual":"5.17.*","status":"unaffected","versionType":"semver"},{"version":"5.18.3","lessThanOrEqual":"5.18.*","status":"unaffected","versionType":"semver"},{"version":"5.19","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.15.46"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.17.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.18.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.19"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/ac2eab7de458f5e1210ce1237afab40a307075c8"},{"url":"https://git.kernel.org/stable/c/c4bd6b72df4f01aa866ceb298466d6d07a6bd525"},{"url":"https://git.kernel.org/stable/c/476bfda0be0f9669add92bff604ca78226cf53d1"},{"url":"https://git.kernel.org/stable/c/bc10916e890948d8927a5c8c40fb5dc44be5e1b8"}],"title":"staging: r8188eu: prevent ->Ssid overflow in rtw_wx_set_scan()","x_generator":{"engine":"bippy-1.2.0"}}}}