CVE-2024-47724 (GCVE-0-2024-47724)

Vulnerability from cvelistv5 – Published: 2024-10-21 12:13 – Updated: 2026-08-05 11:39
VLAI
Title
wifi: ath11k: use work queue to process beacon tx event
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: use work queue to process beacon tx event Commit 3a415daa3e8b ("wifi: ath11k: add P2P IE in beacon template") from Feb 28, 2024 (linux-next), leads to the following Smatch static checker warning: drivers/net/wireless/ath/ath11k/wmi.c:1742 ath11k_wmi_p2p_go_bcn_ie() warn: sleeping in atomic context The reason is that ath11k_bcn_tx_status_event() will directly call might sleep function ath11k_wmi_cmd_send() during RCU read-side critical sections. The call trace is like: ath11k_bcn_tx_status_event() -> rcu_read_lock() -> ath11k_mac_bcn_tx_event() -> ath11k_mac_setup_bcn_tmpl() …… -> ath11k_wmi_bcn_tmpl() -> ath11k_wmi_cmd_send() -> rcu_read_unlock() Commit 886433a98425 ("ath11k: add support for BSS color change") added the ath11k_mac_bcn_tx_event(), commit 01e782c89108 ("ath11k: fix warning of RCU usage for ath11k_mac_get_arvif_by_vdev_id()") added the RCU lock to avoid warning but also introduced this BUG. Use work queue to avoid directly calling ath11k_mac_bcn_tx_event() during RCU critical sections. No need to worry about the deletion of vif because cancel_work_sync() will drop the work if it doesn't start or block vif deletion until the running work is done. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 3a415daa3e8ba65f1cc976c172a5ab69bdc17e69 , < dbd51da69dda1137723b8f66460bf99a9dac8dd2 (git)
Affected: 3a415daa3e8ba65f1cc976c172a5ab69bdc17e69 , < 6db232905e094e64abff1f18249905d068285e09 (git)
Affected: 3a415daa3e8ba65f1cc976c172a5ab69bdc17e69 , < 177b49dbf9c1d8f9f25a22ffafa416fc2c8aa6a3 (git)
Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.10.13 , ≤ 6.10.* (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47724",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T13:01:30.955907Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:04:16.907Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath11k/core.h",
            "drivers/net/wireless/ath/ath11k/mac.c",
            "drivers/net/wireless/ath/ath11k/wmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dbd51da69dda1137723b8f66460bf99a9dac8dd2",
              "status": "affected",
              "version": "3a415daa3e8ba65f1cc976c172a5ab69bdc17e69",
              "versionType": "git"
            },
            {
              "lessThan": "6db232905e094e64abff1f18249905d068285e09",
              "status": "affected",
              "version": "3a415daa3e8ba65f1cc976c172a5ab69bdc17e69",
              "versionType": "git"
            },
            {
              "lessThan": "177b49dbf9c1d8f9f25a22ffafa416fc2c8aa6a3",
              "status": "affected",
              "version": "3a415daa3e8ba65f1cc976c172a5ab69bdc17e69",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath11k/core.h",
            "drivers/net/wireless/ath/ath11k/mac.c",
            "drivers/net/wireless/ath/ath11k/wmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: use work queue to process beacon tx event\n\nCommit 3a415daa3e8b (\"wifi: ath11k: add P2P IE in beacon template\")\nfrom Feb 28, 2024 (linux-next), leads to the following Smatch static\nchecker warning:\n\ndrivers/net/wireless/ath/ath11k/wmi.c:1742 ath11k_wmi_p2p_go_bcn_ie()\nwarn: sleeping in atomic context\n\nThe reason is that ath11k_bcn_tx_status_event() will directly call might\nsleep function ath11k_wmi_cmd_send() during RCU read-side critical\nsections. The call trace is like:\n\nath11k_bcn_tx_status_event()\n-\u003e rcu_read_lock()\n-\u003e ath11k_mac_bcn_tx_event()\n\t-\u003e ath11k_mac_setup_bcn_tmpl()\n\t\u2026\u2026\n\t\t-\u003e ath11k_wmi_bcn_tmpl()\n\t\t\t-\u003e ath11k_wmi_cmd_send()\n-\u003e rcu_read_unlock()\n\nCommit 886433a98425 (\"ath11k: add support for BSS color change\") added the\nath11k_mac_bcn_tx_event(), commit 01e782c89108 (\"ath11k: fix warning\nof RCU usage for ath11k_mac_get_arvif_by_vdev_id()\") added the RCU lock\nto avoid warning but also introduced this BUG.\n\nUse work queue to avoid directly calling ath11k_mac_bcn_tx_event()\nduring RCU critical sections. No need to worry about the deletion of vif\nbecause cancel_work_sync() will drop the work if it doesn\u0027t start or\nblock vif deletion until the running work is done.\n\nTested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The trigger is the ath11k AP\u0027s BSS color-change state, which an attacker forces by transmitting beacons carrying the AP\u0027s BSS color in the HE Operation IE, causing firmware OBSS color-collision detection and an automatic hostapd color change. This requires only being within WiFi radio range of the target AP, not a routable network path.\nAC:L - Once a color change is active, every beacon TX status event (roughly every 100 ms) deterministically enters ath11k_mac_bcn_tx_event() and calls the might_sleep() WMI send from tasklet/RCU context, and the attacker controls the collision beacon that starts the color change. No unpredictable memory layout or victim state is needed.\nPR:N - Injecting a beacon frame with a colliding BSS color requires no association, authentication, or credentials on the target AP, and no account on the host. The color change that arms the bug is initiated automatically by hostapd in response to the attacker\u0027s frame.\nUI:N - No action by any user or administrator is needed; the OBSS color-collision notification and the resulting color change are handled automatically by the firmware, mac80211, and hostapd.\nS:U - The corruption and crash are confined to the kernel of the AP device itself, with no crossing into a different security authority such as a hypervisor or IOMMU boundary.\nC:H - Sleeping inside the RCU read-side critical section makes the voluntary schedule a quiescent state, so synchronize_rcu() in the pdev/vdev teardown path can complete while ath11k_mac_setup_bcn_tmpl() still dereferences the freed ath11k_vif/ath11k structures, yielding a use-after-free read of kernel heap contents.\nI:H - The same use-after-free window lets the driver write into freed memory (arvif-\u003ersnie_present, wpaie_present, bcca_zero_sent, and WMI command buffers built from freed ar/wmi pointers), and the missing conf_mutex means these writes race with vdev deletion; additionally wait_event_timeout() in tasklet context corrupts an unrelated task\u0027s state and leaves a wait-queue entry on the interrupt stack.\nA:H - Calling a might_sleep() function from the CE tasklet produces \"BUG: sleeping function called from invalid context\" and, when WMI credits are unavailable, \"BUG: scheduling while atomic\" with a potential panic; the tasklet never reaches its enable_irq(), permanently disabling the Copy Engine interrupt and wedging the wireless device."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:39:44.134Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dbd51da69dda1137723b8f66460bf99a9dac8dd2"
        },
        {
          "url": "https://git.kernel.org/stable/c/6db232905e094e64abff1f18249905d068285e09"
        },
        {
          "url": "https://git.kernel.org/stable/c/177b49dbf9c1d8f9f25a22ffafa416fc2c8aa6a3"
        }
      ],
      "title": "wifi: ath11k: use work queue to process beacon tx event",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47724",
    "datePublished": "2024-10-21T12:13:58.267Z",
    "dateReserved": "2024-09-30T16:00:12.956Z",
    "dateUpdated": "2026-08-05T11:39:44.134Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47724",
      "date": "2026-08-11",
      "epss": "0.00338",
      "percentile": "0.26501"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.10\", \"versionEndExcluding\": \"6.10.13\", \"matchCriteriaId\": \"767D4D2D-C6E7-4B7D-9446-CFC8F8FF2FBB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.2\", \"matchCriteriaId\": \"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath11k: use work queue to process beacon tx event\\n\\nCommit 3a415daa3e8b (\\\"wifi: ath11k: add P2P IE in beacon template\\\")\\nfrom Feb 28, 2024 (linux-next), leads to the following Smatch static\\nchecker warning:\\n\\ndrivers/net/wireless/ath/ath11k/wmi.c:1742 ath11k_wmi_p2p_go_bcn_ie()\\nwarn: sleeping in atomic context\\n\\nThe reason is that ath11k_bcn_tx_status_event() will directly call might\\nsleep function ath11k_wmi_cmd_send() during RCU read-side critical\\nsections. The call trace is like:\\n\\nath11k_bcn_tx_status_event()\\n-\u003e rcu_read_lock()\\n-\u003e ath11k_mac_bcn_tx_event()\\n\\t-\u003e ath11k_mac_setup_bcn_tmpl()\\n\\t\\u2026\\u2026\\n\\t\\t-\u003e ath11k_wmi_bcn_tmpl()\\n\\t\\t\\t-\u003e ath11k_wmi_cmd_send()\\n-\u003e rcu_read_unlock()\\n\\nCommit 886433a98425 (\\\"ath11k: add support for BSS color change\\\") added the\\nath11k_mac_bcn_tx_event(), commit 01e782c89108 (\\\"ath11k: fix warning\\nof RCU usage for ath11k_mac_get_arvif_by_vdev_id()\\\") added the RCU lock\\nto avoid warning but also introduced this BUG.\\n\\nUse work queue to avoid directly calling ath11k_mac_bcn_tx_event()\\nduring RCU critical sections. No need to worry about the deletion of vif\\nbecause cancel_work_sync() will drop the work if it doesn\u0027t start or\\nblock vif deletion until the running work is done.\\n\\nTested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath11k: usar cola de trabajo para procesar evento beacon tx el commit 3a415daa3e8b (\\\"wifi: ath11k: agregar P2P IE en plantilla beacon\\\") del 28 de febrero de 2024 (linux-next) genera la siguiente advertencia del verificador est\\u00e1tico de Smatch: drivers/net/wireless/ath/ath11k/wmi.c:1742 ath11k_wmi_p2p_go_bcn_ie() warn: durmiendo en contexto at\\u00f3mico La raz\\u00f3n es que ath11k_bcn_tx_status_event() llamar\\u00e1 directamente a la funci\\u00f3n de suspensi\\u00f3n ath11k_wmi_cmd_send() durante las secciones cr\\u00edticas del lado de lectura de RCU. El seguimiento de la llamada es as\\u00ed: ath11k_bcn_tx_status_event() -\u0026gt; rcu_read_lock() -\u0026gt; ath11k_mac_bcn_tx_event() -\u0026gt; ath11k_mac_setup_bcn_tmpl() \\u2026\\u2026 -\u0026gt; ath11k_wmi_bcn_tmpl() -\u0026gt; ath11k_wmi_cmd_send() -\u0026gt; rcu_read_unlock() el commit 886433a98425 (\\\"ath11k: agregar soporte para cambio de color BSS\\\") agreg\\u00f3 ath11k_mac_bcn_tx_event(), el commit 01e782c89108 (\\\"ath11k: corregir advertencia de uso de RCU para ath11k_mac_get_arvif_by_vdev_id()\\\") agreg\\u00f3 el bloqueo de RCU para evitar advertencias pero tambi\\u00e9n introdujo este ERROR. Utilice la cola de trabajo para evitar llamar directamente a ath11k_mac_bcn_tx_event() durante las secciones cr\\u00edticas de RCU. No es necesario preocuparse por la eliminaci\\u00f3n de vif porque cancel_work_sync() descartar\\u00e1 el trabajo si no comienza o bloquear\\u00e1 la eliminaci\\u00f3n de vif hasta que finalice el trabajo en ejecuci\\u00f3n. Probado en: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30\"}]",
      "id": "CVE-2024-47724",
      "lastModified": "2024-10-23T21:41:13.390",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-10-21T13:15:02.590",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/177b49dbf9c1d8f9f25a22ffafa416fc2c8aa6a3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6db232905e094e64abff1f18249905d068285e09\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/dbd51da69dda1137723b8f66460bf99a9dac8dd2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47724\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T13:15:02.590\",\"lastModified\":\"2026-08-04T11:20:44.753\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath11k: use work queue to process beacon tx event\\n\\nCommit 3a415daa3e8b (\\\"wifi: ath11k: add P2P IE in beacon template\\\")\\nfrom Feb 28, 2024 (linux-next), leads to the following Smatch static\\nchecker warning:\\n\\ndrivers/net/wireless/ath/ath11k/wmi.c:1742 ath11k_wmi_p2p_go_bcn_ie()\\nwarn: sleeping in atomic context\\n\\nThe reason is that ath11k_bcn_tx_status_event() will directly call might\\nsleep function ath11k_wmi_cmd_send() during RCU read-side critical\\nsections. The call trace is like:\\n\\nath11k_bcn_tx_status_event()\\n-\u003e rcu_read_lock()\\n-\u003e ath11k_mac_bcn_tx_event()\\n\\t-\u003e ath11k_mac_setup_bcn_tmpl()\\n\\t\u2026\u2026\\n\\t\\t-\u003e ath11k_wmi_bcn_tmpl()\\n\\t\\t\\t-\u003e ath11k_wmi_cmd_send()\\n-\u003e rcu_read_unlock()\\n\\nCommit 886433a98425 (\\\"ath11k: add support for BSS color change\\\") added the\\nath11k_mac_bcn_tx_event(), commit 01e782c89108 (\\\"ath11k: fix warning\\nof RCU usage for ath11k_mac_get_arvif_by_vdev_id()\\\") added the RCU lock\\nto avoid warning but also introduced this BUG.\\n\\nUse work queue to avoid directly calling ath11k_mac_bcn_tx_event()\\nduring RCU critical sections. No need to worry about the deletion of vif\\nbecause cancel_work_sync() will drop the work if it doesn\u0027t start or\\nblock vif deletion until the running work is done.\\n\\nTested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath11k: usar cola de trabajo para procesar evento beacon tx el commit 3a415daa3e8b (\\\"wifi: ath11k: agregar P2P IE en plantilla beacon\\\") del 28 de febrero de 2024 (linux-next) genera la siguiente advertencia del verificador est\u00e1tico de Smatch: drivers/net/wireless/ath/ath11k/wmi.c:1742 ath11k_wmi_p2p_go_bcn_ie() warn: durmiendo en contexto at\u00f3mico La raz\u00f3n es que ath11k_bcn_tx_status_event() llamar\u00e1 directamente a la funci\u00f3n de suspensi\u00f3n ath11k_wmi_cmd_send() durante las secciones cr\u00edticas del lado de lectura de RCU. El seguimiento de la llamada es as\u00ed: ath11k_bcn_tx_status_event() -\u0026gt; rcu_read_lock() -\u0026gt; ath11k_mac_bcn_tx_event() -\u0026gt; ath11k_mac_setup_bcn_tmpl() \u2026\u2026 -\u0026gt; ath11k_wmi_bcn_tmpl() -\u0026gt; ath11k_wmi_cmd_send() -\u0026gt; rcu_read_unlock() el commit 886433a98425 (\\\"ath11k: agregar soporte para cambio de color BSS\\\") agreg\u00f3 ath11k_mac_bcn_tx_event(), el commit 01e782c89108 (\\\"ath11k: corregir advertencia de uso de RCU para ath11k_mac_get_arvif_by_vdev_id()\\\") agreg\u00f3 el bloqueo de RCU para evitar advertencias pero tambi\u00e9n introdujo este ERROR. Utilice la cola de trabajo para evitar llamar directamente a ath11k_mac_bcn_tx_event() durante las secciones cr\u00edticas de RCU. No es necesario preocuparse por la eliminaci\u00f3n de vif porque cancel_work_sync() descartar\u00e1 el trabajo si no comienza o bloquear\u00e1 la eliminaci\u00f3n de vif hasta que finalice el trabajo en ejecuci\u00f3n. Probado en: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/ath/ath11k/core.h\",\"drivers/net/wireless/ath/ath11k/mac.c\",\"drivers/net/wireless/ath/ath11k/wmi.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3a415daa3e8ba65f1cc976c172a5ab69bdc17e69\",\"lessThan\":\"dbd51da69dda1137723b8f66460bf99a9dac8dd2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3a415daa3e8ba65f1cc976c172a5ab69bdc17e69\",\"lessThan\":\"6db232905e094e64abff1f18249905d068285e09\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3a415daa3e8ba65f1cc976c172a5ab69bdc17e69\",\"lessThan\":\"177b49dbf9c1d8f9f25a22ffafa416fc2c8aa6a3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/ath/ath11k/core.h\",\"drivers/net/wireless/ath/ath11k/mac.c\",\"drivers/net/wireless/ath/ath11k/wmi.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.13\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.2\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-21T13:01:30.955907Z\",\"id\":\"CVE-2024-47724\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10\",\"versionEndExcluding\":\"6.10.13\",\"matchCriteriaId\":\"767D4D2D-C6E7-4B7D-9446-CFC8F8FF2FBB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.2\",\"matchCriteriaId\":\"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/177b49dbf9c1d8f9f25a22ffafa416fc2c8aa6a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6db232905e094e64abff1f18249905d068285e09\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dbd51da69dda1137723b8f66460bf99a9dac8dd2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T17:52:38+00:00",
      "cve": "CVE-2024-47724",
      "id": "CVE-2024-47724",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: ath11k: use work queue to process beacon tx event",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47724.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-26T00:04:12Z",
      "cve": "CVE-2024-47724",
      "id": "CVE-2024-47724",
      "initial_release_date": "2025-09-22T23:32:56Z",
      "product_status:known_not_affected": "402",
      "product_status:recommended": "65",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-47724",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-47724.json",
      "version": "6"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47724\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T13:01:30.955907Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T13:01:34.056Z\"}}], \"cna\": {\"title\": \"wifi: ath11k: use work queue to process beacon tx event\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3a415daa3e8ba65f1cc976c172a5ab69bdc17e69\", \"lessThan\": \"dbd51da69dda1137723b8f66460bf99a9dac8dd2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3a415daa3e8ba65f1cc976c172a5ab69bdc17e69\", \"lessThan\": \"6db232905e094e64abff1f18249905d068285e09\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3a415daa3e8ba65f1cc976c172a5ab69bdc17e69\", \"lessThan\": \"177b49dbf9c1d8f9f25a22ffafa416fc2c8aa6a3\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/wireless/ath/ath11k/core.h\", \"drivers/net/wireless/ath/ath11k/mac.c\", \"drivers/net/wireless/ath/ath11k/wmi.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/wireless/ath/ath11k/core.h\", \"drivers/net/wireless/ath/ath11k/mac.c\", \"drivers/net/wireless/ath/ath11k/wmi.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/dbd51da69dda1137723b8f66460bf99a9dac8dd2\"}, {\"url\": \"https://git.kernel.org/stable/c/6db232905e094e64abff1f18249905d068285e09\"}, {\"url\": \"https://git.kernel.org/stable/c/177b49dbf9c1d8f9f25a22ffafa416fc2c8aa6a3\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath11k: use work queue to process beacon tx event\\n\\nCommit 3a415daa3e8b (\\\"wifi: ath11k: add P2P IE in beacon template\\\")\\nfrom Feb 28, 2024 (linux-next), leads to the following Smatch static\\nchecker warning:\\n\\ndrivers/net/wireless/ath/ath11k/wmi.c:1742 ath11k_wmi_p2p_go_bcn_ie()\\nwarn: sleeping in atomic context\\n\\nThe reason is that ath11k_bcn_tx_status_event() will directly call might\\nsleep function ath11k_wmi_cmd_send() during RCU read-side critical\\nsections. The call trace is like:\\n\\nath11k_bcn_tx_status_event()\\n-\u003e rcu_read_lock()\\n-\u003e ath11k_mac_bcn_tx_event()\\n\\t-\u003e ath11k_mac_setup_bcn_tmpl()\\n\\t\\u2026\\u2026\\n\\t\\t-\u003e ath11k_wmi_bcn_tmpl()\\n\\t\\t\\t-\u003e ath11k_wmi_cmd_send()\\n-\u003e rcu_read_unlock()\\n\\nCommit 886433a98425 (\\\"ath11k: add support for BSS color change\\\") added the\\nath11k_mac_bcn_tx_event(), commit 01e782c89108 (\\\"ath11k: fix warning\\nof RCU usage for ath11k_mac_get_arvif_by_vdev_id()\\\") added the RCU lock\\nto avoid warning but also introduced this BUG.\\n\\nUse work queue to avoid directly calling ath11k_mac_bcn_tx_event()\\nduring RCU critical sections. No need to worry about the deletion of vif\\nbecause cancel_work_sync() will drop the work if it doesn\u0027t start or\\nblock vif deletion until the running work is done.\\n\\nTested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.13\", \"versionStartIncluding\": \"6.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"6.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:39:32.401Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47724\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:39:32.401Z\", \"dateReserved\": \"2024-09-30T16:00:12.956Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T12:13:58.267Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.