Executive brief
A vulnerability in the Linux kernel's wireless networking component could allow a high-privileged user to cause a system-wide freeze or 'soft lockup.' By providing an extremely large value for certain Wi-Fi transmission queue parameters, the system's processor can become stuck in an infinite or excessive loop. This results in a denial-of-service where the machine becomes unresponsive to other tasks.
Technical details
The vulnerability is a denial-of-service (soft lockup) within the cfg80211 component of the Linux kernel. It is caused by a lack of range validation for the NL80211_ATTR_TXQ_QUANTUM attribute in the netlink interface. An attacker with sufficient privileges (typically CAP_NET_ADMIN) can set this value to 2^31, leading to an infinite or extremely long loop during packet dequeueing in the mac80211 layer (specifically within ieee80211_tx_dequeue). This consumes CPU resources indefinitely, triggering the kernel's watchdog timer. The fix involves implementing a netlink_range_validation policy to restrict the quantum value to INT_MAX.
Affected products
- Linux Linux kernel 6.9.0-rc7
Timeline
- 2024-06-15: patched: Initial patch submitted by Eric Dumazet
- 2024-07-30: advisory: CVE-2024-42114 published
References
- https://git.kernel.org/stable/c/33ac5a4eb3d4bea2146658f1b6d1fa86d62d2b22
- https://git.kernel.org/stable/c/3fc06f6d142d2840735543216a60d0a8c345bdec
- https://git.kernel.org/stable/c/80ac0cc9c0bef984e29637b1efa93d7214b42f53
- https://git.kernel.org/stable/c/8a3ac7fb36962c34698f884bd697938054ff2afa
- https://git.kernel.org/stable/c/d1cba2ea8121e7fdbe1328cea782876b1dd80993
- https://git.kernel.org/stable/c/e87c2f098f52aa2fe20258a5bb1738d6a74e9ed7
- https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html