Kalle Valo

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.4.89 **Description** A kernel panic issue has been resolved in the Linux kernel. The problem occurred during the unload and load of ath11k modules, causing a kernel panic due to an internal error. The issue was related to the `napi by id` function and the `netif napi add` function. The error was triggered when the `ath11k ahb config irq` function was called, leading to a crash. The issue was identified on a Generic DT based system with a CPU PID of 4435. **Recommendations** For Linux kernel version 5.4.89 and earlier, update to a newer version to resolve the issue. As a temporary workaround, consider disabling the `ath11k ahb config irq` function until a patch is available. Restrict access to the `ath11k ahb` module to minimize the risk of exploitation. Avoid using the `napi by id` function in the affected API endpoint until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: The issue is related to an array out-of-bounds access in the SoC stats of the ath12k wifi driver. The `ath12k soc dp stats::hal reo error` array is defined with a maximum size of `DP REO DST RING MAX`. However, the `ath12k dp rx process()` function accesses this array using the REO destination SRNG ring ID, which is incorrect. This leads to out-of-bounds array access. The fix involves modifying the `ath12k dp rx process()` function to use the normal ring ID directly instead of the SRNG ring ID. Recommendations: To resolve the issue, update the Linux kernel to version 6.6.58 or later. As a temporary workaround, consider modifying the `ath12k dp rx process()` function to use the normal ring ID directly instead of the SRNG ring ID to avoid out-of-bounds array access. Restrict access to the vulnerable `ath12k soc dp stats::hal reo error` array to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the wifi: ath11k: fix dfs radar event locking in the Linux kernel. The ath11k active pdevs are protected by RCU, but the DFS radar event handling code calling `ath11k mac get ar by pdev id()` was not marked as a read-side critical section. This could lead to potential use-after-free issues. The code in question has been marked as an RCU read-side critical section to avoid these issues. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.0.11 **Description** An issue in the Linux kernel's WILC1000 wireless driver is related to a heap-based buffer overflow. This occurs due to missing validation of the number of channels when copying the list of operating channels from Wi-Fi management frames. The exploitation of this issue can allow an attacker to execute arbitrary code or cause a denial of service. **Recommendations** For Linux kernel versions prior to 6.0.11, update to version 6.0.11 or later to resolve the issue. As a temporary workaround, consider disabling the WILC1000 wireless driver until a patch is available. Restrict access to the `cfg80211.c` module in the WILC1000 driver to minimize the risk of exploitation. Avoid using the vulnerable function related to channel validation in the affected driver until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.0.11 **Description** The issue is related to the WILC1000 wireless driver in the Linux kernel, where missing validation of `IEEE80211 P2P ATTR CHANNEL LIST` in `drivers/net/wireless/microchip/wilc1000/cfg80211.c` can trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames. This can potentially allow an attacker to execute arbitrary code or cause a denial of service. **Recommendations** For Linux kernel versions prior to 6.0.11, update to version 6.0.11 or later to resolve the issue. As a temporary workaround, consider disabling the WILC1000 wireless driver until a patch is available. Restrict access to the vulnerable `cfg80211.c` module to minimize the risk of exploitation. Avoid using the `IEEE80211 P2P ATTR CHANNEL LIST` attribute in the affected API endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.0.11 **Description** The issue is related to the WILC1000 wireless driver in the Linux kernel, specifically with the missing validation of `IEEE80211 P2P ATTR OPER CHANNEL` in the `cfg80211.c` file. This can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames, potentially allowing an attacker to execute arbitrary code or cause a denial of service. **Recommendations** For Linux kernel versions prior to 6.0.11, update to version 6.0.11 or later to resolve the issue. As a temporary workaround, consider disabling the WILC1000 wireless driver until a patch is available. Restrict access to the vulnerable `cfg80211.c` file to minimize the risk of exploitation. Avoid using the `IEEE80211 P2P ATTR OPER CHANNEL` attribute in the affected API endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.0.11 **Description** An issue in the Linux kernel's WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet, potentially allowing an attacker to cause a denial of service or elevate privileges. **Recommendations** For Linux kernel versions prior to 6.0.11, update to version 6.0.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the `hif.c` file in the `drivers/net/wireless/microchip/wilc1000` directory to minimize the risk of exploitation. Avoid using the `RSN` information element in Netlink packets until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A vulnerability in the Linux kernel has been resolved. The issue was related to the ath11k module, where the use of `mhi async power up()` instead of `mhi sync power up()` could cause a crash during the removal of the ath11k pci module if the amss.bin file was missing. The `mhi sync power up()` function checks for errors, which prevents the crash. The reason for using the async version is unknown. The vulnerability can cause a general protection fault, likely due to a null pointer dereference. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A crash is observed in the Linux kernel when ath11k modules are removed using rmmod with spectral scan enabled. The crash occurs due to a NULL pointer dereference. To avoid this crash, a spectral scan disable WMI command is sent to the firmware before cleaning the spectral dbring in the spectral deinit API. **Recommendations** As a temporary workaround, consider disabling the spectral scan feature until a patch is available. To resolve the issue, send a spectral scan disable WMI command to the firmware before cleaning the spectral dbring in the spectral deinit API.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A buffer overflow issue exists in the Linux kernel, specifically in the ath11k driver. The scan req params structure can hold a maximum of 10 SSIDs, but the driver reports a capacity of 16 SSIDs, leading to a potential buffer overflow when copying SSIDs into the structure. This issue can be triggered from wpa supplicant in userspace. The firmware supports up to 64 probe requests, with 16 SSIDs and 4 BSSIDs each. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a possible array out of bound access in the `mt7921 mcu tx rate report` function. This could potentially lead to security issues. The problem has been resolved by fixing the array out of bound issue and removing an unnecessary variable in the `mt7921 mcu tx rate report` function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.