CVE-2024-43842: wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter()

Q: What is the severity of CVE-2024-43842?

CVE-2024-43842 has a severity rating that needs to be assessed based on the specific context and impact within affected systems.

Q: How do I fix CVE-2024-43842?

To fix CVE-2024-43842, update the Linux kernel to one of the versions that contain the fix such as 5.10.223-1, 5.10.226-1, 6.1.123-1, or later versions listed in the remediation.

Q: Which versions of the Linux kernel are affected by CVE-2024-43842?

CVE-2024-43842 affects several earlier versions of the Linux kernel, specifically those before the patched versions mentioned in the remediation.

Q: Is CVE-2024-43842 a critical vulnerability?

The criticality of CVE-2024-43842 should be determined based on its exploitability and impact on organizational systems.

Q: What components are directly related to CVE-2024-43842?

CVE-2024-43842 relates directly to the rtw89 driver in the Linux kernel, specifically in the function rtw89_sta_info_get_iter().

Published Aug 17, 2024

Updated

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw89: Fix array index mistake in rtw89stainfogetiter()

In rtw89stainfogetiter() 'status->hegi' is compared to array size. But then 'rate->hegi' is used as array index instead of 'status->hegi'. This can lead to go beyond array boundaries in case of 'rate->hegi' is not equal to 'status->hegi' and is bigger than array size. Looks like "copy-paste" mistake.

Fix this mistake by replacing 'rate->hegi' with 'status->hegi'.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Affected Software

149 affected componentsFixes available

Linux Linux kernel>=5.16<6.1.103

Linux Linux kernel>=6.2<6.6.44

Linux Linux kernel>=6.7<6.10.3

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15*

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm-5.15*

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15*

ubuntu/linux-lowlatency-hwe-5.15*

ubuntu/linux-nvidia-tegra-5.15*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15*

ubuntu/linux-riscv-5.8*

ubuntu/linux*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1020.22~22.04.1

6.8.0-1020.22~22.04.1

ubuntu/linux-azure*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1020.23~22.04.1

6.8.0-1020.23~22.04.1

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1019.21~22.04.1

6.8.0-1019.21~22.04.1

ubuntu/linux-gke*

ubuntu/linux-gkeop*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-50.51~22.04.1

6.8.0-50.51~22.04.1

ubuntu/linux-ibm*

ubuntu/linux-ibm-6.8<6.8.0-1017.17~22.04.1

6.8.0-1017.17~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg*

ubuntu/linux-kvm*

ubuntu/linux-lowlatency*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-50.51.1~22.04.1

6.8.0-50.51.1~22.04.1

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1019.21~22.04.1

6.8.0-1019.21~22.04.1

ubuntu/linux-nvidia-tegra*

ubuntu/linux-nvidia-tegra-igx*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1017.18~22.04.1

6.8.0-1017.18~22.04.1

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-50.51.1~22.04.1

6.8.0-50.51.1~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-bluefield*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-realtime*

ubuntu/linux-realtime-6.8<6.8.1-1013.14~22.04.1

6.8.1-1013.14~22.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<6.8.0-50.51

6.8.0-50.51

ubuntu/linux-aws<6.8.0-1020.22

6.8.0-1020.22

ubuntu/linux-azure<6.8.0-1020.23

6.8.0-1020.23

ubuntu/linux-gcp<6.8.0-1019.21

6.8.0-1019.21

ubuntu/linux-gke<6.8.0-1015.19

6.8.0-1015.19

ubuntu/linux-gkeop<6.8.0-1002.4

6.8.0-1002.4

ubuntu/linux-ibm<6.8.0-1017.17

6.8.0-1017.17

ubuntu/linux-lowlatency<6.8.0-50.51.1

6.8.0-50.51.1

ubuntu/linux-nvidia<6.8.0-1019.21

6.8.0-1019.21

ubuntu/linux-nvidia-lowlatency<6.8.0-1019.21.1

6.8.0-1019.21.1

ubuntu/linux-oem-6.8<6.8.0-1018.18

6.8.0-1018.18

ubuntu/linux-oracle<6.8.0-1017.18

6.8.0-1017.18

ubuntu/linux-raspi<6.8.0-1016.18

6.8.0-1016.18

ubuntu/linux-riscv<6.8.0-50.51.1

6.8.0-50.51.1

ubuntu/linux-xilinx<6.8.0-1017.18

6.8.0-1017.18

ubuntu/linux-raspi-realtime<6.8.0-2015.16

6.8.0-2015.16

ubuntu/linux-realtime<6.8.1-1013.14

6.8.1-1013.14

ubuntu/linux-fips<6.8.0-78.78+fips1

6.8.0-78.78+fips1

debian/linux<6.1.106-1

6.1.106-1

debian/linux<6.10.3-1

6.10.3-1

debian/linux<6.10.3-1

6.10.3-1

debian/linux

6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Upgrade
Upgrade debian/linux-6.1 to a version that resolves this vulnerability.
Fixed in 6.1.129-1~deb11u1
Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1020.22~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1020.23~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1019.21~22.04.1
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-50.51~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1017.17~22.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-50.51.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1019.21~22.04.1
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1017.18~22.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-50.51.1~22.04.1
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1013.14~22.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-50.51
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1020.22
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1020.23
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1019.21
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1015.19
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1002.4
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1017.17
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-50.51.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1019.21
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1019.21.1
Upgrade
Upgrade ubuntu/linux-oem-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1018.18
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1017.18
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1016.18
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 6.8.0-50.51.1
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1017.18
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2015.16
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1013.14
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-78.78+fips1

Event History

Aug 17, 2024

CVE Published

via MITRE·09:21 AM

Data Sourced

via MITRE·09:21 AM

Description

Data Sourced

via OSV·10:15 AM

DescriptionSeverityAffected Software

Data Sourced

via NVD·10:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4008-1

Frequently Asked Questions

What is the severity of CVE-2024-43842?

CVE-2024-43842 has a severity rating that needs to be assessed based on the specific context and impact within affected systems.

How do I fix CVE-2024-43842?

To fix CVE-2024-43842, update the Linux kernel to one of the versions that contain the fix such as 5.10.223-1, 5.10.226-1, 6.1.123-1, or later versions listed in the remediation.

Which versions of the Linux kernel are affected by CVE-2024-43842?

CVE-2024-43842 affects several earlier versions of the Linux kernel, specifically those before the patched versions mentioned in the remediation.

Is CVE-2024-43842 a critical vulnerability?

The criticality of CVE-2024-43842 should be determined based on its exploitability and impact on organizational systems.

What components are directly related to CVE-2024-43842?

CVE-2024-43842 relates directly to the rtw89 driver in the Linux kernel, specifically in the function rtw89_sta_info_get_iter().

CVE-2024-43842: wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter()

Affected Software

Remediation

Event History

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-43842?

How do I fix CVE-2024-43842?

Which versions of the Linux kernel are affected by CVE-2024-43842?

Is CVE-2024-43842 a critical vulnerability?

What components are directly related to CVE-2024-43842?

Company

Resources

Contact