CVE-2022-50871 (GCVE-0-2022-50871)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:15 – Updated: 2026-08-05 08:59
VLAI
Title
wifi: ath11k: Fix qmi_msg_handler data structure initialization
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Fix qmi_msg_handler data structure initialization qmi_msg_handler is required to be null terminated by QMI module. There might be a case where a handler for a msg id is not present in the handlers array which can lead to infinite loop while searching the handler and therefore out of bound access in qmi_invoke_handler(). Hence update the initialization in qmi_msg_handler data structure. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d5c65159f2895379e11ca13f62feabe93278985d , < d5d71de448f36e34592f7c81b5e300d3e8dbb735 (git)
Affected: d5c65159f2895379e11ca13f62feabe93278985d , < a10e1530c424bb277b4edc7def0195857a548495 (git)
Affected: d5c65159f2895379e11ca13f62feabe93278985d , < ed3725e15a154ebebf44e0c34806c57525483f92 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.6
Unaffected: 0 , < 5.6 (semver)
Unaffected: 6.0.16 , ≤ 6.0.* (semver)
Unaffected: 6.1.2 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath11k/qmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d5d71de448f36e34592f7c81b5e300d3e8dbb735",
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "versionType": "git"
            },
            {
              "lessThan": "a10e1530c424bb277b4edc7def0195857a548495",
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "versionType": "git"
            },
            {
              "lessThan": "ed3725e15a154ebebf44e0c34806c57525483f92",
              "status": "affected",
              "version": "d5c65159f2895379e11ca13f62feabe93278985d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath11k/qmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.16",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.2",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: Fix qmi_msg_handler data structure initialization\n\nqmi_msg_handler is required to be null terminated by QMI module.\nThere might be a case where a handler for a msg id is not present in the\nhandlers array which can lead to infinite loop while searching the handler\nand therefore out of bound access in qmi_invoke_handler().\nHence update the initialization in qmi_msg_handler data structure.\n\nTested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in ath11k QMI indication handling over AF_QIPCRTR; QRTR delivers datagrams to the QMI client port with no connected-peer filter, so an unprivileged local process can send a crafted QMI message and reach qmi_invoke_handler(). This is host IPC, not WiFi frame processing, so Adjacent/Network do not apply.\nAC:L - The attacker only needs to send a QMI indication/request with a msg_id absent from ath11k_qmi_msg_handlers[]; the missing null terminator makes the OOB walk deterministic. Discovering the client port (ephemeral QRTR range) is fully under attacker control.\nPR:L - AF_QIPCRTR sockets can be created and bound to ephemeral ports without privileges; no CAP_NET_ADMIN is required to send to another local QRTR port. Real root is not required.\nUI:N - Exploitation is a direct local send to the ath11k QMI socket; no victim action is required.\nS:U - Impact is confined to the host kernel\u0027s memory/control-flow integrity; there is no VM/IOMMU/security-authority boundary crossing.\nC:H - qmi_invoke_handler() performs an unbounded out-of-bounds read of adjacent kernel memory while scanning for a handler, and a crafted type/msg_id can select a false adjacent handler entry, enabling further disclosure primitives.\nI:H - Matching an out-of-bounds handler descriptor can invoke a garbage function pointer and/or run qmi_decode_message() with attacker-influenced ei/decoded_size, yielding memory corruption and control-flow hijack potential.\nA:H - The same path can soft-lock in an unbounded scan, oops on unmapped access, or crash when a bogus handler is invoked, as confirmed by the sibling ath12k KASAN global-OOB report for the identical terminator bug."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:59:55.262Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d5d71de448f36e34592f7c81b5e300d3e8dbb735"
        },
        {
          "url": "https://git.kernel.org/stable/c/a10e1530c424bb277b4edc7def0195857a548495"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed3725e15a154ebebf44e0c34806c57525483f92"
        }
      ],
      "title": "wifi: ath11k: Fix qmi_msg_handler data structure initialization",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50871",
    "datePublished": "2025-12-30T12:15:41.372Z",
    "dateReserved": "2025-12-30T12:06:07.136Z",
    "dateUpdated": "2026-08-05T08:59:55.262Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50871",
      "date": "2026-09-26",
      "epss": "0.00151",
      "percentile": "0.03636"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/ath/ath11k/qmi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d5d71de448f36e34592f7c81b5e300d3e8dbb735",
                    "status": "affected",
                    "version": "d5c65159f2895379e11ca13f62feabe93278985d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a10e1530c424bb277b4edc7def0195857a548495",
                    "status": "affected",
                    "version": "d5c65159f2895379e11ca13f62feabe93278985d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ed3725e15a154ebebf44e0c34806c57525483f92",
                    "status": "affected",
                    "version": "d5c65159f2895379e11ca13f62feabe93278985d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/ath/ath11k/qmi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.6"
                  },
                  {
                    "lessThan": "5.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: Fix qmi_msg_handler data structure initialization\n\nqmi_msg_handler is required to be null terminated by QMI module.\nThere might be a case where a handler for a msg id is not present in the\nhandlers array which can lead to infinite loop while searching the handler\nand therefore out of bound access in qmi_invoke_handler().\nHence update the initialization in qmi_msg_handler data structure.\n\nTested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1"
          }
        ],
        "id": "CVE-2022-50871",
        "lastModified": "2026-08-04T10:18:25.137",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-30T13:16:02.030",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a10e1530c424bb277b4edc7def0195857a548495"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d5d71de448f36e34592f7c81b5e300d3e8dbb735"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ed3725e15a154ebebf44e0c34806c57525483f92"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:36:15+00:00",
      "cve": "CVE-2022-50871",
      "id": "CVE-2022-50871",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: ath11k: Fix qmi_msg_handler data structure initialization",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50871.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:18:10Z",
      "cve": "CVE-2022-50871",
      "id": "CVE-2022-50871",
      "initial_release_date": "2025-12-31T00:30:50Z",
      "product_status:known_affected": "128",
      "product_status:known_not_affected": "432",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50871",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50871.json",
      "version": "13"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.