CVE-2024-49938: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9khtc: Use skbsetlength() for resetting urb before resubmit
Syzbot points out that skbtrim() has a sanity check on the existing length of the skb, which can be uninitialised in some error paths. The intent here is clearly just to reset the length to zero before resubmitting, so switch to calling skbsetlength(skb, 0) directly. In addition, skbsetlength() already contains a call to skbresettailpointer(), so remove the redundant call.
The syzbot report came from ath9khifusbregincb(), but there's a similar usage of skbtrim() in ath9khifusbrxcb(), change both while we're at it.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49938?
CVE-2024-49938 has been classified as having a moderate severity level in the Linux kernel.
What versions of the Linux kernel are affected by CVE-2024-49938?
CVE-2024-49938 affects Linux kernel versions prior to 5.10.227 and between 5.11 and 6.1.113, as well as other specific versions up to 6.11.
How do I fix CVE-2024-49938?
To fix CVE-2024-49938, update your Linux kernel to a version that is patched, such as 6.1.123-1 or 6.12.15-1.
What type of vulnerability is CVE-2024-49938?
CVE-2024-49938 is a vulnerability in the wifi driver related to incorrect handling of skb structure leading to potential memory corruption.
Is CVE-2024-49938 exploitable in the wild?
While there is no public proof of concept available, the nature of CVE-2024-49938 indicates that it could potentially be exploited under specific conditions.