CVE-2022-47519

What it actually does

Out-of-bounds write in the WILC1000 wireless driver due to missing validation of the IEEE80211_P2P_ATTR_OPER_CHANNEL attribute when parsing channel list data from Wi-Fi management frames in cfg80211.c.

Why it matters to the business

Local attackers can gain full system control or cause crashes on Linux devices using Microchip WILC1000 hardware, disrupting wireless connectivity and exposing sensitive operations to compromise.

How an attack unfolds

An attacker with local access supplies malformed Wi-Fi management frames containing an invalid P2P channel list attribute. The driver parses the IEEE80211_P2P_ATTR_OPER_CHANNEL without bounds checking, triggering an out-of-bounds write that corrupts kernel memory and enables privilege escalation or code execution.

How to fix it

Upgrade the Linux kernel to version 6.0.11 or newer by applying commit 051ae669e4505abbe05165bebf6be7922de11f41, which adds proper validation for the P2P channel attribute in the WILC1000 driver.

How to confirm the fix worked

Confirm the running kernel is 6.0.11 or later, verify the patch exists in drivers/net/wireless/microchip/wilc1000/cfg80211.c, and test that malformed P2P frames no longer cause out-of-bounds writes.

Typical attack path

1. Obtain local user access on the target Linux system
2. Craft or inject Wi-Fi management frames with oversized or invalid OPER_CHANNEL attributes
3. Force the WILC1000 driver to process the frames via cfg80211
4. Trigger the missing validation to perform an out-of-bounds write
5. Leverage memory corruption for arbitrary code execution

How to detect it

Inspect kernel logs (dmesg, syslog) for wilc1000 or cfg80211 crashes, memory corruption warnings, or unexpected P2P attribute parsing errors; correlate with wireless frame processing events around the time of suspected incidents.

What your security team should do

• Apply the kernel update containing commit 051ae669e4505abbe05165bebf6be7922de11f41 on all systems using the WILC1000 driver
• Limit local user privileges on wireless-enabled hosts
• Review wireless driver logs for anomalies after patching