CVE-2022-50732

Vulnerability

CVE-2022-50732 is a use-after-free vulnerability in the Linux kernel's staging rtl8192u driver. In the function ieee80211_rx(), the code dereferences the skb pointer after calling ieee80211_monitor_rx(), which may have freed the skb, leading to a use-after-free condition [1][2].

Exploitation

The vulnerability can be triggered by an attacker who can send specially crafted network packets to a system using the rtl8192u driver. The driver processes received packets in ieee80211_rx() and, under certain conditions, passes the skb to ieee80211_monitor_rx(), which may free it. Subsequent use of the freed pointer allows an attacker to potentially corrupt memory or execute arbitrary code [3][4].

Impact

Successful exploitation could lead to memory corruption, system crashes, or privilege escalation. The vulnerability is in the staging tree, which may not be widely used, but affected systems should be patched.

Mitigation

The issue has been fixed in the Linux kernel through commits [1][2][3][4]. Users should update to a kernel version containing the fix, or apply the relevant patches.