Junglewise Threat Intelligence

CVE-2024-50008: Linux Kernel mwifiex memory corruption in 802.11 scan

CVE-2024-50008 · Severity: medium · CVSS 5.5 · Published 2024-10-21

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Marvell Wi-Fi driver (mwifiex) could allow a local user to cause a system crash. The issue stems from how the driver handles memory when scanning for wireless networks. An exploit could lead to a denial-of-service, impacting the availability of the affected device.

Technical details

A vulnerability exists in the mwifiex driver within the Linux kernel due to a field-spanning write in the mwifiex_cmd_802_11_scan_ext() function. The root cause is the use of a one-element array (tlv_buffer[1]) in struct host_cmd_ds_802_11_scan_ext, which triggers a FORTIFY_SOURCE memcpy warning when more than one byte is written to the buffer. An attacker with local privileges could potentially exploit this memory corruption to cause a kernel panic (Denial of Service). The fix involves replacing the one-element array with a flexible-array member and adjusting buffer length calculations. Patches have been released across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel up to 5.10.227, 5.11 to 5.15.168, 5.16 to 6.1.113, 6.2 to 6.6.55, 6.7 to 6.10.14, 6.11 to 6.11.3

Timeline

  • 2024-10-21: advisory: CVE-2024-50008 published
  • 2024-10-17: patched: Fix committed to stable kernel trees

References

Related threats