CVE-2022-50297
BaseFortify
Publication date: 2025-09-15
Last updated on: 2025-12-04
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 2.6.35 (inc) to 4.9.337 (exc) |
| linux | linux_kernel | From 4.10 (inc) to 4.14.303 (exc) |
| linux | linux_kernel | From 4.15 (inc) to 4.19.270 (exc) |
| linux | linux_kernel | From 4.20 (inc) to 5.4.229 (exc) |
| linux | linux_kernel | From 5.5 (inc) to 5.10.163 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.86 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.0.16 (exc) |
| linux | linux_kernel | From 6.1 (inc) to 6.1.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's ath9k wireless driver when a USB device incorrectly claims to be an ATH9K device but does not have the expected USB endpoints. Specifically, the driver expects a bulk endpoint but finds an interrupt endpoint instead. This mismatch causes the kernel to encounter an internal error when handling such devices.
How can this vulnerability impact me? :
The impact of this vulnerability is that the Linux kernel may experience internal errors or instability when a USB device misrepresents itself as an ATH9K device with incorrect endpoints. This could lead to system crashes or malfunctioning of the wireless driver when such devices are connected.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring system logs for error messages related to USB devices claiming to be ATH9K but having incorrect endpoints. Specifically, look for kernel log entries containing messages like 'usb 1-1: BOGUS urb xfer, pipe 3 != type 1' or warnings from usb_submit_urb in the kernel logs. You can use commands such as 'dmesg | grep usb' or 'journalctl -k | grep usb' to search for these messages.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where this vulnerability is resolved, as the issue arises from improper handling of USB endpoints in the ath9k driver. Until an update is applied, avoid connecting USB devices that claim to be ATH9K but may have incorrect endpoint configurations to prevent kernel errors.