Executive brief
A vulnerability in the Linux kernel's Marvell Wi-Fi driver (mwifiex) could allow a local user to cause a system crash. The issue stems from how the driver handles memory when scanning for wireless networks. An exploit could lead to a denial-of-service, impacting the availability of the affected device.
Technical details
A vulnerability exists in the mwifiex driver within the Linux kernel due to a field-spanning write in the mwifiex_cmd_802_11_scan_ext() function. The root cause is the use of a one-element array (tlv_buffer[1]) in struct host_cmd_ds_802_11_scan_ext, which triggers a FORTIFY_SOURCE memcpy warning when more than one byte is written to the buffer. An attacker with local privileges could potentially exploit this memory corruption to cause a kernel panic (Denial of Service). The fix involves replacing the one-element array with a flexible-array member and adjusting buffer length calculations. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel up to 5.10.227, 5.11 to 5.15.168, 5.16 to 6.1.113, 6.2 to 6.6.55, 6.7 to 6.10.14, 6.11 to 6.11.3
Timeline
- 2024-10-21: advisory: CVE-2024-50008 published
- 2024-10-17: patched: Fix committed to stable kernel trees
References
- https://git.kernel.org/stable/c/17199b69a84798efffc475040fbef44374ef1de1
- https://git.kernel.org/stable/c/1756918f51e9ab247a0f4782cc28853c2bb457c1
- https://git.kernel.org/stable/c/498365e52bebcbc36a93279fe7e9d6aec8479cee
- https://git.kernel.org/stable/c/71267bd4e8c752d7af6c6b96bb83984a6a95273d
- https://git.kernel.org/stable/c/a3a12c30f9510f3753286fadbc6cdb7dad78c1d5
- https://git.kernel.org/stable/c/b55c8848fdc81514ec047b2a0ec782ffe9ab5323
- https://git.kernel.org/stable/c/e59bdb1ba594104cd0ee0af3ee9e4435d842a8fe