Executive brief
A vulnerability was found in the Linux kernel's networking component for IEEE 802.15.4 (low-power wireless) devices. This flaw can cause a system crash (kernel panic) when a wireless network interface is removed while the hardware is being unregistered. An attacker with local access could exploit this to disrupt system availability and cause a denial-of-service.
Technical details
A race condition exists in net/mac802154/iface.c within the ieee802154_if_remove function. The vulnerability occurs when a network interface is removed concurrently with the unregistration of the underlying IEEE 802.15.4 hardware device. Specifically, if ieee802154_remove_interfaces is called on one CPU while ieee802154_if_remove is called on another, the sdata list can be corrupted, leading to a 'kernel BUG' or NULL pointer dereference (CWE-476). The fix introduces a check for local->interfaces before attempting to delete the sdata list entry. This is a local attack vector requiring low privileges. Patches have been backported to various stable kernel branches including 5.4.y, 5.10.y, 5.15.y, 6.1.y, 6.6.y, and 6.12.y.
Affected products
- Linux Linux kernel up to 5.4.290, 5.5 to 5.10.234, 5.11 to 5.15.177, 5.16 to 6.1.127, 6.2 to 6.6.75, 6.7 to 6.12.11, 6.13-rc1 to 6.13-rc6
Timeline
- 2024-11-13: patched: Initial patch submitted by Lizhi Xu
- 2025-01-31: disclosed: CVE-2024-57948 published
References
- https://git.kernel.org/stable/c/0d11dc30edfc4acef0acef130bb5ca596317190a
- https://git.kernel.org/stable/c/2e41e98c4e79edae338f2662dbdf74ac2245d183
- https://git.kernel.org/stable/c/41e4ca8acba39f1cecff2dfdf14ace4ee52c4272
- https://git.kernel.org/stable/c/80aee0bc0dbe253b6692d33e64455dc742fc52f1
- https://git.kernel.org/stable/c/98ea165a2ac240345c48b57c0a3d08bbcad02929
- https://git.kernel.org/stable/c/b856d2c1384bc5a7456262afd21aa439ee5cdf6e
- https://git.kernel.org/stable/c/eb09fbeb48709fe66c0d708aed81e910a577a30a