Junglewise Threat Intelligence

CVE-2024-49930: Linux Kernel ath11k out-of-bounds access in SoC stats

CVE-2024-49930 · Severity: high · CVSS 7.8 · Published 2024-10-21

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's Qualcomm ath11k Wi-Fi driver. This driver is responsible for managing wireless network connectivity on devices using specific Qualcomm chipsets. An exploit could allow a local user to cause a system crash or potentially gain unauthorized access to sensitive kernel memory, impacting the stability and security of the device.

Technical details

An out-of-bounds array access vulnerability exists in the ath11k Wi-Fi driver within the Linux kernel. The root cause is located in the ath11k_dp_process_rx() function, which incorrectly uses the REO destination SRNG ring ID to index the ath11k_soc_dp_stats::hal_reo_error array. Because SRNG ring IDs differ from the expected normal ring IDs, this can result in an index that exceeds the DP_REO_DST_RING_MAX boundary. A local attacker could leverage this flaw to corrupt kernel memory or cause a denial-of-service (system crash). The issue has been addressed in multiple stable kernel branches by modifying the function to use the correct ring ID.

Affected products

  • Linux Linux Kernel up to 5.10.227, 5.11 to 5.15.168, 5.16 to 6.1.113, 6.2 to 6.6.55, 6.7 to 6.10.14, 6.11 to 6.11.3

Timeline

  • 2024-10-21: disclosed
  • 2024-10-21: advisory
  • 2024-10-10: patched: Initial patches applied to stable trees.

References

Related threats