Executive brief
A memory leak vulnerability was identified in the Linux kernel's wireless mesh networking component. This component is responsible for managing how devices connect to each other in a mesh Wi-Fi network. An attacker could exploit this flaw to gradually exhaust the system's available memory, potentially leading to a system crash or a denial-of-service condition where the device becomes unresponsive.
Technical details
A memory leak exists in the mac80211 mesh implementation within the Linux kernel. The Hybrid Wireless Mesh Protocol (HWMP) code utilizes 'mesh_preq_queue' objects to track mesh path (mpath) resolutions. When a mesh interface is removed or an mpath is deleted, these objects are not properly flushed from the list in 'ieee80211_if_mesh'. This results in unreferenced objects remaining in the kernel memory (CWE-401). A local attacker can trigger this leak to cause memory exhaustion. The issue is resolved by ensuring all corresponding items in the 'preq_queue' are flushed during 'mesh_path_flush_pending()'. Patches have been released for multiple stable kernel branches.
Affected products
- Linux Linux kernel 2.6.26 to 4.19.317, 4.20 to 5.4.279, 5.5 to 5.10.221, 5.11 to 5.15.162, 5.16 to 6.1.95, 6.2 to 6.6.35, 6.7 to 6.9.6, 6.10-rc1, 6.10-rc2
Timeline
- 2024-05-28: other: Vulnerability fixed in upstream kernel source
- 2024-07-12: advisory: CVE-2024-40942 published
References
- https://git.kernel.org/stable/c/377dbb220edc8421b7960691876c5b3bef62f89b
- https://git.kernel.org/stable/c/617dadbfb2d3e152c5753e28356d189c9d6f33c0
- https://git.kernel.org/stable/c/63d5f89bb5664d60edbf8cf0df911aaae8ed96a4
- https://git.kernel.org/stable/c/7518e20a189f8659b8b83969db4d33a4068fcfc3
- https://git.kernel.org/stable/c/b7d7f11a291830fdf69d3301075dd0fb347ced84
- https://git.kernel.org/stable/c/c4c865f971fd4a255208f57ef04d814c2ae9e0dc
- https://git.kernel.org/stable/c/d81e244af521de63ad2883e17571b789c39b6549