PT-2024-29246 · Linux+5 · Linux Kernel+5
Syzbot
·
Published
2024-05-31
·
Updated
2025-02-03
·
CVE-2024-41072
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.43
Description
A vulnerability in the Linux kernel has been resolved. The issue is related to the wifi functionality, specifically in the
cfg80211 wext siwscan() function, where an extra check has been added to ensure that the number of channels passed via ioctl(sock, SIOCSIWSCAN, ...) does not exceed IW MAX FREQUENCIES. If the number of channels exceeds this limit, the request is rejected with -EINVAL.Recommendations
Update to Linux kernel version 6.6.43 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
cfg80211 wext siwscan() function until a patch is available. Avoid using the ioctl(sock, SIOCSIWSCAN, ...) call with a large number of channels until the issue is resolved.Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu