CVE-2024-35913: wifi: iwlwifi: mvm: pick the version of SESSION_PROTECTION_NOTIF
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: pick the version of SESSIONPROTECTIONNOTIF
The Linux kernel CVE team has assigned CVE-2024-35913 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051956-CVE-2024-35913-72a4@gregkh/T
Other sources
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: pick the version of SESSIONPROTECTIONNOTIF
When we want to know whether we should look for the macid or the linkid in struct iwlmvmsessionprotnotif, we should look at the version of SESSIONPROTECTIONNOTIF.
This causes WARNINGs:
WARNING: CPU: 0 PID: 11403 at drivers/net/wireless/intel/iwlwifi/mvm/time-event.c:959 iwlmvmrxsessionprotectnotif+0x333/0x340 [iwlmvm] RIP: 0010:iwlmvmrxsessionprotectnotif+0x333/0x340 [iwlmvm] Code: 00 49 c7 84 24 48 07 00 00 00 00 00 00 41 c6 84 24 78 07 00 00 ff 4c 89 f7 e8 e9 71 54 d9 e9 7d fd ff ff 0f 0b e9 23 fe ff ff <0f> 0b e9 1c fe ff ff 66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffb4bb00003d40 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff9ae63a361000 RCX: ffff9ae4a98b60d4 RDX: ffff9ae4588499c0 RSI: 0000000000000305 RDI: ffff9ae4a98b6358 RBP: ffffb4bb00003d68 R08: 0000000000000003 R09: 0000000000000010 R10: ffffb4bb00003d00 R11: 000000000000000f R12: ffff9ae441399050 R13: ffff9ae4761329e8 R14: 0000000000000001 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff9ae7af400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055fb75680018 CR3: 00000003dae32006 CR4: 0000000000f70ef0 PKRU: 55555554 Call Trace: <IRQ> ? showregs+0x69/0x80 ? warn+0x8d/0x150 ? iwlmvmrxsessionprotectnotif+0x333/0x340 [iwlmvm] ? reportbug+0x196/0x1c0 ? handlebug+0x45/0x80 ? excinvalidop+0x1c/0xb0 ? asmexcinvalidop+0x1f/0x30 ? iwlmvmrxsessionprotectnotif+0x333/0x340 [iwlmvm] iwlmvmrxcommon+0x115/0x340 [iwlmvm] iwlmvmrxmq+0xa6/0x100 [iwlmvm] iwlpcierxhandle+0x263/0xa10 [iwlwifi] iwlpcienapipollmsix+0x32/0xd0 [iwlwifi]
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.5 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35913?
CVE-2024-35913 has been assigned a severity rating that indicates potential security risks due to vulnerabilities in the Linux kernel.
How do I fix CVE-2024-35913?
To fix CVE-2024-35913, upgrade to the appropriate kernel versions as specified by your Linux distribution.
Which versions of the Linux kernel are affected by CVE-2024-35913?
CVE-2024-35913 affects specific versions of the Red Hat and Debian Linux kernel packages.
Is CVE-2024-35913 a remote or local vulnerability?
CVE-2024-35913 is identified as a local vulnerability affecting users with kernel access.
What is the main issue related to CVE-2024-35913?
The main issue associated with CVE-2024-35913 is a vulnerability in the iwlwifi component of the Linux kernel.