CVE-2024-56663: wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one
In the Linux kernel, the following vulnerability has been resolved:
wifi: nl80211: fix NL80211ATTRMLOLINKID off-by-one
Since the netlink attribute range validation provides inclusive checking, the max of attribute NL80211ATTRMLOLINKID should be IEEE80211MLDMAXNUMLINKS - 1 otherwise causing an off-by-one.
One crash stack for demonstration: ================================================================== BUG: KASAN: wild-memory-access in ieee80211txcontrolport+0x3b6/0xca0 net/mac80211/tx.c:5939 Read of size 6 at addr 001102080000000c by task fuzzer.386/9508
CPU: 1 PID: 9508 Comm: syz.1.386 Not tainted 6.1.70 #2 Call Trace: <TASK> dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0x177/0x231 lib/dumpstack.c:106 printreport+0xe0/0x750 mm/kasan/report.c:398 kasanreport+0x139/0x170 mm/kasan/report.c:495 kasancheckrange+0x287/0x290 mm/kasan/generic.c:189 memcpy+0x25/0x60 mm/kasan/shadow.c:65 ieee80211txcontrolport+0x3b6/0xca0 net/mac80211/tx.c:5939 rdevtxcontrolport net/wireless/rdev-ops.h:761 [inline] nl80211txcontrolport+0x7b3/0xc40 net/wireless/nl80211.c:15453 genlfamilyrcvmsgdoit+0x22e/0x320 net/netlink/genetlink.c:756 genlfamilyrcvmsg net/netlink/genetlink.c:833 [inline] genlrcvmsg+0x539/0x740 net/netlink/genetlink.c:850 netlinkrcvskb+0x1de/0x420 net/netlink/afnetlink.c:2508 genlrcv+0x24/0x40 net/netlink/genetlink.c:861 netlinkunicastkernel net/netlink/afnetlink.c:1326 [inline] netlinkunicast+0x74b/0x8c0 net/netlink/afnetlink.c:1352 netlinksendmsg+0x882/0xb90 net/netlink/afnetlink.c:1874 socksendmsgnosec net/socket.c:716 [inline] socksendmsg net/socket.c:728 [inline] syssendmsg+0x5cc/0x8f0 net/socket.c:2499 syssendmsg+0x21c/0x290 net/socket.c:2553 syssendmsg net/socket.c:2582 [inline] dosyssendmsg net/socket.c:2591 [inline] sesyssendmsg+0x19e/0x270 net/socket.c:2589 dosyscallx64 arch/x86/entry/common.c:51 [inline] dosyscall64+0x45/0x90 arch/x86/entry/common.c:81 entrySYSCALL64afterhwframe+0x63/0xcd
Update the policy to ensure correct validation.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
Update the netlink attribute range validation for NL80211_ATTR_MLO_LINK_ID to use an inclusive max of IEEE80211_MLD_MAX_NUM_LINKS - 1 (instead of IEEE80211_MLD_MAX_NUM_LINKS) to fix the off-by-one.
Linux kernel nl80211 attribute validation (wifi: nl80211) NL80211_ATTR_MLO_LINK_ID max = IEEE80211_MLD_MAX_NUM_LINKS - 1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56663?
CVE-2024-56663 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-56663?
To fix CVE-2024-56663, update the Linux kernel to a version that is above 5.20, 6.1.121, 6.6.67, 6.12.6, 6.13-rc1, or 6.13-rc2.
What versions of the Linux kernel are affected by CVE-2024-56663?
CVE-2024-56663 affects versions of the Linux kernel from 5.19.2 up to 5.20, from 6.0 up to 6.1.121, from 6.2 up to 6.6.67, and from 6.7 up to 6.12.6.
Is CVE-2024-56663 a critical vulnerability?
No, CVE-2024-56663 is not classified as a critical vulnerability but it may pose risks to system stability and security.
What type of vulnerability is CVE-2024-56663?
CVE-2024-56663 is an off-by-one error vulnerability in the validation of netlink attributes in the Linux kernel's wifi nl80211 subsystem.