CVE-2024-49931
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
21/10/2024
Last modified:
25/10/2024
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
wifi: ath12k: fix array out-of-bound access in SoC stats<br />
<br />
Currently, the ath12k_soc_dp_stats::hal_reo_error array is defined with a<br />
maximum size of DP_REO_DST_RING_MAX. However, the ath12k_dp_rx_process()<br />
function access ath12k_soc_dp_stats::hal_reo_error using the REO<br />
destination SRNG ring ID, which is incorrect. SRNG ring ID differ from<br />
normal ring ID, and this usage leads to out-of-bounds array access. To<br />
fix this issue, modify ath12k_dp_rx_process() to use the normal ring ID<br />
directly instead of the SRNG ring ID to avoid out-of-bounds array access.<br />
<br />
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.6.55 (excluding) | |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.7 (including) | 6.10.14 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.11 (including) | 6.11.3 (excluding) |
To consult the complete list of CPE names with products and versions, see this page