CVE-2024-27410

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
17/05/2024
Last modified:
17/12/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: nl80211: reject iftype change with mesh ID change<br /> <br /> It&amp;#39;s currently possible to change the mesh ID when the<br /> interface isn&amp;#39;t yet in mesh mode, at the same time as<br /> changing it into mesh mode. This leads to an overwrite<br /> of data in the wdev-&gt;u union for the interface type it<br /> currently has, causing cfg80211_change_iface() to do<br /> wrong things when switching.<br /> <br /> We could probably allow setting an interface to mesh<br /> while setting the mesh ID at the same time by doing a<br /> different order of operations here, but realistically<br /> there&amp;#39;s no userspace that&amp;#39;s going to do this, so just<br /> disallow changes in iftype when setting mesh ID.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.19.2 (including) 6.1.81 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.6.21 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.7.9 (excluding)
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*