Executive brief
A race condition exists in the Linux kernel's ath9k wireless driver, which supports various Qualcomm Atheros Wi-Fi adapters. The vulnerability occurs because the driver exposes the device to the system before it has finished setting up its internal data structures. A local attacker could exploit this timing issue to cause a system crash (NULL pointer dereference), leading to a denial of service.
Technical details
A race condition (CWE-362) exists in the ath9k_htc driver within the Linux kernel. The root cause is an improper initialization sequence where the device is exposed to the USB subsystem before the driver's internal data structures are fully initialized. Specifically, the 'ath9k_wmi_event_tasklet()' may execute and attempt to access structures that have not yet been allocated or populated, leading to a NULL pointer dereference. While a previous fix addressed this for specific transmit status events, this vulnerability covers other WMI commands triggered during the race window. An attacker with local access can trigger this race to cause a kernel panic (Denial of Service). The fix involves moving the synchronization bit to cover the entire tasklet and ensuring it is only set at the end of 'ath9k_htc_probe_device()'.
Affected products
- Linux Linux Kernel 5.10.136 to 5.10.214, 5.15.17 to 5.15.153, 5.16.3 to 6.1.83, 6.2 to 6.6.23, 6.7 to 6.7.11, 6.8 to 6.8.2
Timeline
- 2024-01-26: patched: Initial patch authored
- 2024-04-17: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1bc5461a21c56a36e2a7d81e152b90ce019a3905
- https://git.kernel.org/stable/c/24355fcb0d4cbcb6ddda262596558e8cfba70f11
- https://git.kernel.org/stable/c/4afa0246656d5680c8a4c3fb37ba6570c4ab819b
- https://git.kernel.org/stable/c/74d0639261dd795dce958d1b14815bdcbb48a715
- https://git.kernel.org/stable/c/a015fbf698c8957aa5fbeefc5c59dd2cf3107298
- https://git.kernel.org/stable/c/ac90e22e735bac44f74b5161fb096fbeb0ff8bc2
- https://git.kernel.org/stable/c/f8ff4b4df71e87f609be0cc37d92e918107f9b90