cve-2024-57898
Vulnerability from cvelistv5
Published
2025-01-15 13:05
Modified
2025-01-20 06:29
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: clear link ID from bitmap during link delete after clean up Currently, during link deletion, the link ID is first removed from the valid_links bitmap before performing any clean-up operations. However, some functions require the link ID to remain in the valid_links bitmap. One such example is cfg80211_cac_event(). The flow is - nl80211_remove_link() cfg80211_remove_link() ieee80211_del_intf_link() ieee80211_vif_set_links() ieee80211_vif_update_links() ieee80211_link_stop() cfg80211_cac_event() cfg80211_cac_event() requires link ID to be present but it is cleared already in cfg80211_remove_link(). Ultimately, WARN_ON() is hit. Therefore, clear the link ID from the bitmap only after completing the link clean-up.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ae07daf440d3220d0986e676317a5da66e4f9dfd
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b5c32ff6a3a38c74facdd1fe34c0d709a55527fd
Impacted products
Vendor Product Version
Linux Linux Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
 Create a notification for this product.
   Linux Linux Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/cfg.c",
            "net/wireless/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ae07daf440d3220d0986e676317a5da66e4f9dfd",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b5c32ff6a3a38c74facdd1fe34c0d709a55527fd",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/cfg.c",
            "net/wireless/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: clear link ID from bitmap during link delete after clean up\n\nCurrently, during link deletion, the link ID is first removed from the\nvalid_links bitmap before performing any clean-up operations. However, some\nfunctions require the link ID to remain in the valid_links bitmap. One\nsuch example is cfg80211_cac_event(). The flow is -\n\nnl80211_remove_link()\n    cfg80211_remove_link()\n        ieee80211_del_intf_link()\n            ieee80211_vif_set_links()\n                ieee80211_vif_update_links()\n                    ieee80211_link_stop()\n                        cfg80211_cac_event()\n\ncfg80211_cac_event() requires link ID to be present but it is cleared\nalready in cfg80211_remove_link(). Ultimately, WARN_ON() is hit.\n\nTherefore, clear the link ID from the bitmap only after completing the link\nclean-up."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-20T06:29:08.752Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ae07daf440d3220d0986e676317a5da66e4f9dfd"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5c32ff6a3a38c74facdd1fe34c0d709a55527fd"
        }
      ],
      "title": "wifi: cfg80211: clear link ID from bitmap during link delete after clean up",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-57898",
    "datePublished": "2025-01-15T13:05:49.718Z",
    "dateReserved": "2025-01-11T14:45:42.029Z",
    "dateUpdated": "2025-01-20T06:29:08.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-57898\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-15T13:15:14.427\",\"lastModified\":\"2025-01-15T13:15:14.427\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: cfg80211: clear link ID from bitmap during link delete after clean up\\n\\nCurrently, during link deletion, the link ID is first removed from the\\nvalid_links bitmap before performing any clean-up operations. However, some\\nfunctions require the link ID to remain in the valid_links bitmap. One\\nsuch example is cfg80211_cac_event(). The flow is -\\n\\nnl80211_remove_link()\\n    cfg80211_remove_link()\\n        ieee80211_del_intf_link()\\n            ieee80211_vif_set_links()\\n                ieee80211_vif_update_links()\\n                    ieee80211_link_stop()\\n                        cfg80211_cac_event()\\n\\ncfg80211_cac_event() requires link ID to be present but it is cleared\\nalready in cfg80211_remove_link(). Ultimately, WARN_ON() is hit.\\n\\nTherefore, clear the link ID from the bitmap only after completing the link\\nclean-up.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: cfg80211: borrar el ID del enlace del mapa de bits durante la eliminaci\u00f3n del enlace despu\u00e9s de la limpieza. Actualmente, durante la eliminaci\u00f3n del enlace, el ID del enlace se elimina primero del mapa de bits valid_links antes de realizar cualquier operaci\u00f3n de limpieza. Sin embargo, algunas funciones requieren que el ID del enlace permanezca en el mapa de bits valid_links. Un ejemplo de ello es cfg80211_cac_event(). El flujo es el siguiente: nl80211_remove_link() cfg80211_remove_link() ieee80211_del_intf_link() ieee80211_vif_set_links() ieee80211_vif_update_links() ieee80211_link_stop() cfg80211_cac_event() cfg80211_cac_event() requiere que el ID del enlace est\u00e9 presente, pero ya se borr\u00f3 en cfg80211_remove_link(). En \u00faltima instancia, se ejecuta WARN_ON(). Por lo tanto, borre el ID del enlace del mapa de bits solo despu\u00e9s de completar la limpieza del enlace.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/ae07daf440d3220d0986e676317a5da66e4f9dfd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b5c32ff6a3a38c74facdd1fe34c0d709a55527fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.