PT-2024-2303 · Unknown+1 · Inet Wireless Daemon+1

Alex Radocea · Published 2024-03-03 · Updated 2025-01-08 · CVE-2024-28084

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions iNet wireless daemon (IWD) versions 2.15 and earlier

Description The issue is related to initialization problems in the p2putil.c component of the iNet wireless daemon (IWD), which can cause a denial of service (daemon crash) or possibly have other unspecified impacts when parsing of advertised service information fails. This can be exploited by a remote attacker. The vulnerability is particularly powerful as it can lead to information leaks, helping to bypass ASLR and other hardening measures. The problem occurs in the extract p2p advertised service info() function, where errors in processing can result in a double-free condition.

Recommendations For iNet wireless daemon (IWD) versions 2.15 and earlier, consider disabling the extract p2p advertised service info() function as a temporary workaround until a patch is available. Restrict access to the vulnerable p2putil.c component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

BDU:2024-02237

CVE-2024-28084

OPENSUSE-SU-2024:14125-1

Affected Products

Debian

Inet Wireless Daemon

References · 26

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KSGT4IZ23CJBOQA3AFYEMBJ5OHFZBMK · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-28084 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28084 · Security Note
• https://ubuntu.com/security/CVE-2024-28084 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14125-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4KSGT4IZ23CJBOQA3AFYEMBJ5OHFZBMK · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYRPQ3OLV3GGLUCDYWBHU34DLBLM62XJ · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/AYRPQ3OLV3GGLUCDYWBHU34DLBLM62XJ · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-28084 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02237 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28084 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-28084 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-28084 · Security Note
• https://t.me/defcon_news/122267 · Telegram Post
• https://git.kernel.org/pub/scm/network/wireless/iwd.git/commit/?id=d34b4e16e045142590ed7cb653e01ed0ae5362eb · Note