CVE-2024-49930: wifi: ath11k: fix array out-of-bound access in SoC stats
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: fix array out-of-bound access in SoC stats
Currently, the ath11ksocdpstats::halreoerror array is defined with a maximum size of DPREODSTRINGMAX. However, the ath11kdpprocessrx() function access ath11ksocdpstats::halreoerror using the REO destination SRNG ring ID, which is incorrect. SRNG ring ID differ from normal ring ID, and this usage leads to out-of-bounds array access. To fix this issue, modify ath11kdpprocessrx() to use the normal ring ID directly instead of the SRNG ring ID to avoid out-of-bounds array access.
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPLSILICONZ-1
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
Modify ath11k_dp_process_rx() so that it indexes ath11k_soc_dp_stats::hal_reo_error using the normal ring ID rather than the REO destination SRNG ring ID, since SRNG ring IDs differ from normal ring IDs and can cause out-of-bounds access beyond DP_REO_DST_RING_MAX.
Linux kernel (ath11k) ath11k_dp_process_rx() access logic for ath11k_soc_dp_stats::hal_reo_error = Use the normal ring ID directly (not the SRNG destination ring ID) when indexing ath11k_soc_dp_stats::hal_reo_error to avoid out-of-bounds array access
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49930?
CVE-2024-49930 is classified as a high severity vulnerability due to its potential to cause an array out-of-bounds access.
How do I fix CVE-2024-49930?
To fix CVE-2024-49930, update your Linux kernel to the latest patched version that addresses this issue.
What versions of Linux are affected by CVE-2024-49930?
CVE-2024-49930 affects several versions of the Linux kernel up to 6.10.14, including specific versions between 5.10 and 6.11.
What components are involved in CVE-2024-49930?
CVE-2024-49930 involves the ath11k driver in the Linux kernel, specifically related to the handling of SoC statistics.
Is there a workaround for CVE-2024-49930?
There is no official workaround for CVE-2024-49930, hence updating the kernel is the recommended approach to mitigate the vulnerability.