CVE-2024-57899: wifi: mac80211: fix mbss changed flags corruption on 32 bit systems
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: fix mbss changed flags corruption on 32 bit systems
On 32-bit systems, the size of an unsigned long is 4 bytes, while a u64 is 8 bytes. Therefore, when using oreachsetbit(bit, &bits, sizeof(changed) BITSPERBYTE), the code is incorrectly searching for a bit in a 32-bit variable that is expected to be 64 bits in size, leading to incorrect bit finding.
Solution: Ensure that the size of the bits variable is correctly adjusted for each architecture.
Call Trace: ? showregs+0x54/0x58 ? warn+0x6b/0xd4 ? ieee80211linkinfochangenotify+0xcc/0xd4 [mac80211] ? reportbug+0x113/0x150 ? excoverflow+0x30/0x30 ? handlebug+0x27/0x44 ? excinvalidop+0x18/0x50 ? handleexception+0xf6/0xf6 ? excoverflow+0x30/0x30 ? ieee80211linkinfochangenotify+0xcc/0xd4 [mac80211] ? excoverflow+0x30/0x30 ? ieee80211linkinfochangenotify+0xcc/0xd4 [mac80211] ? ieee80211meshwork+0xff/0x260 [mac80211] ? cfg80211wiphywork+0x72/0x98 [cfg80211] ? processonework+0xf1/0x1fc ? workerthread+0x2c0/0x3b4 ? kthread+0xc7/0xf0 ? moddelayedworkon+0x4c/0x4c ? kthreadcompleteandexit+0x14/0x14 ? retfromfork+0x24/0x38 ? kthreadcompleteandexit+0x14/0x14 ? retfromforkasm+0xf/0x14 ? entryINT8032+0xf0/0xf0
[restore no-op path for no changes]
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-57899?
CVE-2024-57899 has a moderate severity rating due to potential flags corruption in the Linux kernel on 32-bit systems.
How do I fix CVE-2024-57899?
To fix CVE-2024-57899, update your Linux kernel to the latest stable version that includes the security patch.
What systems are affected by CVE-2024-57899?
CVE-2024-57899 affects Linux kernel users on 32-bit systems.
Are there any workarounds for CVE-2024-57899?
There are no effective workarounds for CVE-2024-57899; the recommended action is to apply the kernel update.
What component is primarily affected by CVE-2024-57899?
CVE-2024-57899 primarily affects the mac80211 component of the Linux kernel's wireless networking stack.