CVE-2022-23088

The vulnerability is caused by a failure to verify the length of the IEEE 802.11s Mesh ID field in a beacon frame before copying it to a buffer allocated on the kernel heap. When FreeBSD operates in wireless network scanning mode (i.e., not connected to any SSID), it processes received beacon frames from its surroundings. An attacker can broadcast a maliciously crafted beacon frame containing an excessively long Mesh ID field, leading to a heap-based buffer overflow and overwriting critical kernel data structures. The consequence is the ability to execute arbitrary code remotely in the kernel context of the operating system.

An attacker within wireless network range can gain full control of the system through RCE in kernel space, meaning the ability to compromise the confidentiality, integrity, and availability of the entire system.

Apply patches available from the vendor in accordance with the references — see FreeBSD advisory FreeBSD-SA-22:07.wifi_meshid available at https://security.freebsd.org/advisories/FreeBSD-SA-22:07.wifi_meshid.asc. As a temporary measure, consider disabling Wi-Fi interfaces or avoiding network scanning mode on vulnerable systems.

FreeBSD — versions indicated in the vendor's references (advisory FreeBSD-SA-22:07.wifi_meshid)