CVE-2024-53059: wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: Fix response handling in iwlmvmsendrecoverycmd()
1. The size of the response packet is not validated. 2. The response buffer is not freed.
Resolve these issues by switching to iwlmvmsendcmdstatus(), which handles both size validation and frees the buffer.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.173.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.64.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53059?
CVE-2024-53059 is considered a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-53059?
To fix CVE-2024-53059, upgrade to a patched version of the Linux kernel that addresses this issue.
What versions of the Linux kernel are affected by CVE-2024-53059?
CVE-2024-53059 affects Linux kernel versions between 5.1 and 5.4.285, 5.5 and 5.10.229, 5.11 and 5.15.171, 5.16 and 6.1.116, 6.2 and 6.6.60, and 6.7 and 6.11.7.
What is the main issue with CVE-2024-53059?
The main issues with CVE-2024-53059 are the lack of validation for the response packet size and failure to free the response buffer.
Is CVE-2024-53059 a remote or local vulnerability?
CVE-2024-53059 is classified as a local vulnerability affecting components of the Linux kernel.