CVE-2022-47521

What it actually does

Missing validation of IEEE80211_P2P_ATTR_CHANNEL_LIST allows a heap-based buffer overflow in the WILC1000 cfg80211 parsing path when processing operating channel attributes from Wi-Fi management frames.

Why it matters to the business

Local privilege escalation or kernel compromise on systems using the affected Microchip WILC1000 wireless hardware can result in full device takeover, data theft, or denial of service; the large installed base of Linux increases exposure for embedded and general-purpose deployments.

How an attack unfolds

An attacker in radio range crafts a Wi-Fi management frame containing an oversized or malformed P2P channel list attribute, transmits it to a target device running the vulnerable WILC1000 driver, and triggers the overflow during attribute parsing to corrupt heap memory and achieve code execution.

How to fix it

Upgrade the Linux kernel to version 6.0.11 or newer, or apply commit f9b62f9843c7b0afdaecabbcebf1dbba18599408; disable the WILC1000 driver if the hardware is not required.

How to confirm the fix worked

Confirm kernel version is at least 6.0.11 and that the cited commit is present in the driver source; attempt to load a test frame containing an oversized channel list attribute in a lab environment and verify no overflow occurs.

Typical attack path

1. Position within wireless range of target
2. Craft malicious IEEE 802.11 management frame with oversized P2P channel list
3. Transmit frame to trigger driver parsing
4. Exploit resulting heap overflow for arbitrary kernel code execution
5. Establish persistence or exfiltrate data

How to detect it

Inspect kernel logs for WILC1000 driver crashes or warnings during frame processing; correlate wireless interface resets or oops messages with unusual management frame reception; review audit logs for unexpected privilege changes following wireless activity.

What your security team should do

• Prioritize kernel upgrade on all systems exposing WILC1000 hardware to untrusted wireless networks
• Monitor vendor firmware updates that incorporate the upstream fix
• Apply network segmentation or MAC filtering to limit exposure to rogue frames while patches are deployed
• Review wireless driver usage and remove unnecessary WILC1000 modules