Junglewise Threat Intelligence

CVE-2024-35845: Linux Kernel iwlwifi missing NUL termination in debug TLV processing

CVE-2024-35845 · Severity: critical · CVSS 9.1 · Published 2024-05-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Intel Wi-Fi driver (iwlwifi) within the Linux kernel. The software fails to properly validate that certain debug information received from the hardware or firmware is correctly formatted as a text string. This could potentially allow an attacker to cause a system crash or gain unauthorized access to sensitive information stored in the computer's memory.

Technical details

A vulnerability in the Linux kernel's iwlwifi driver (specifically in iwl-dbg-tlv.c) stems from a lack of NUL termination validation for the debug_cfg_name field within the iwl_fw_ini_debug_info_tlv structure. When this field is processed as a string without a terminator, it can lead to out-of-bounds reads or format string vulnerabilities (CWE-134). An attacker could potentially exploit this via malicious firmware or specially crafted debug TLVs to cause a denial of service or disclose kernel memory. The issue has been addressed by adding a strnlen check to ensure the input is properly NUL-terminated before use. Patches are available for multiple stable kernel branches including 5.10, 5.15, 6.1, 6.6, 6.7, and 6.8.

Affected products

  • Linux Linux Kernel 5.5 to 5.10.214, 5.11 to 5.15.153, 5.16 to 6.1.83, 6.2 to 6.6.23, 6.7 to 6.7.11, 6.8 to 6.8.2

Timeline

  • 2024-05-17: disclosed
  • 2024-05-17: advisory
  • 2024-03-26: patched: Date of committer signature on stable branches.

References

Related threats