CVE-2024-43881: wifi: ath12k: change DMA direction while mapping reinjected packets
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: change DMA direction while mapping reinjected packets
For fragmented packets, ath12k reassembles each fragment as a normal packet and then reinjects it into HW ring. In this case, the DMA direction should be DMATODEVICE, not DMAFROMDEVICE. Otherwise, an invalid payload may be reinjected into the HW and subsequently delivered to the host.
Given that arbitrary memory can be allocated to the skb buffer, knowledge about the data contained in the reinjected buffer is lacking. Consequently, there’s a risk of private information being leaked.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPLSILICONZ-1
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.133-1Fixed in 6.12.22-1 - Configuration
Update ath12k so that when mapping reinjected packets (reassembled fragmented packets reinjected into the HW ring), the DMA direction is set to DMA_TO_DEVICE rather than DMA_FROM_DEVICE, preventing invalid reinjected payload delivery to the host.
Linux kernel (ath12k) DMA direction when mapping reinjected packets = DMA_TO_DEVICE (not DMA_FROM_DEVICE)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43881?
The severity of CVE-2024-43881 is currently classified as moderate.
How do I fix CVE-2024-43881?
To fix CVE-2024-43881, update the Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, or 6.12.11-1.
What does CVE-2024-43881 affect?
CVE-2024-43881 affects the Linux kernel's ath12k driver, specifically its handling of DMA direction for reinjecting fragmented packets.
Can CVE-2024-43881 be exploited remotely?
Yes, CVE-2024-43881 can potentially be exploited remotely under certain conditions.
What versions of the Linux kernel are affected by CVE-2024-43881?
CVE-2024-43881 affects various versions of the Linux kernel prior to the fixes mentioned above.