CVE-2022-50871

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: Fix qmi_msg_handler data structure initialization

qmi_msg_handler is required to be null terminated by QMI module. There might be a case where a handler for a msg id is not present in the handlers array which can lead to infinite loop while searching the handler and therefore out of bound access in qmi_invoke_handler(). Hence update the initialization in qmi_msg_handler data structure.

Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1

A flaw was found in the Linux kernel ath11k driver related to improper initialization of the QMI message handler array. The handlers list was not NULL-terminated, allowing qmi_invoke_handler() to iterate past the end of the array when processing an unsupported message ID, leading to an out-of-bounds access. A local attacker with low privileges and control over the wireless interface could trigger this condition, resulting in a kernel crash (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.