CVE-2024-50237: wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: do not pass a stopped vif to the driver in .gettxpower
Avoid potentially crashing in the driver because of uninitialized private data
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50237?
CVE-2024-50237 has been classified as a moderate severity vulnerability in the Linux kernel.
What versions of the Linux kernel are affected by CVE-2024-50237?
CVE-2024-50237 affects multiple versions of the Linux kernel ranging from 3.19 to 6.12-rc5.
What issue does CVE-2024-50237 address in the Linux kernel?
CVE-2024-50237 addresses an issue where a stopped virtual interface could be passed to the driver, potentially leading to crashes due to uninitialized private data.
How do I fix CVE-2024-50237?
To fix CVE-2024-50237, users should update their Linux kernel to a patched version that resolves this vulnerability.
Is there any workaround for CVE-2024-50237?
Currently, there are no reported workarounds for CVE-2024-50237 other than applying the necessary kernel updates.