CVE-2022-47520

What it actually does

Missing offset validation in the WILC1000 wireless driver allows an out-of-bounds read when parsing an RSN information element supplied via a Netlink packet, leading to memory disclosure or a kernel crash.

Why it matters to the business

Systems using affected Microchip WILC1000 hardware on Linux kernels before 6.0.11 face risk of local information leaks or denial of service; prevalence in embedded and IoT devices increases exposure across many deployments.

How an attack unfolds

An attacker with local access crafts a malicious Netlink packet containing an RSN IE with invalid offsets and sends it to the driver; the missing validation triggers an out-of-bounds read that can disclose kernel memory or crash the system.

How to fix it

Update the Linux kernel to version 6.0.11 or later; apply commit cd21d99e595ec1d8721e1058dcdd4f1f7de1d793 to the affected driver file.

How to confirm the fix worked

Verify the running kernel version is 6.0.11 or newer; confirm the hif.c file contains the offset validation added by commit cd21d99e595ec1d8721e1058dcdd4f1f7de1d793; test with crafted Netlink packets in a lab environment.

Typical attack path

1. Obtain local access on a Linux system using the WILC1000 driver
2. Construct a Netlink packet with a malformed RSN information element
3. Deliver the packet to trigger the parsing code in hif.c
4. Observe memory disclosure or kernel panic resulting from the out-of-bounds read

How to detect it

Examine kernel logs for oops or panic messages referencing wilc1000/hif.c; look for unusual Netlink activity involving RSN elements in audit or system logs; no widespread exploitation indicators are known.

What your security team should do

• Prioritize kernel upgrades on all systems using WILC1000 hardware
• Restrict local user access where possible until patches are applied
• Monitor vendor advisories for backported fixes in supported distributions
• Review wireless driver usage in embedded products and schedule updates