CVE-2024-44997 net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()
A use-after-free in the MediaTek WED driver causes a kernel panic when turning down interfaces with multiple APs, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-44997?
CVE-2024-44997 is a high-severity use after free vulnerability in Linux kernel, published on 4 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()
When there are multiple ap interfaces on one band and with WED on, turning the interface down will cause a kernel panic on MT798X.
Previously, cb_priv was freed in mtk_wed_setup_tc_block() without marking NULL,and mtk_wed_setup_tc_block_cb() didn't check the value, too.
Assign NULL after free cb_priv in mtk_wed_setup_tc_block() and check NULL in mtk_wed_setup_tc_block_cb().
---------- Unable to handle kernel paging request at virtual address 0072460bca32b4f5 Call trace: mtk_wed_setup_tc_block_cb+0x4/0x38 0xffffffc0794084bc tcf_block_playback_offloads+0x70/0x1e8 tcf_block_unbind+0x6c/0xc8 ... ---------
Weakness: CWE-416
Which versions are affected by CVE-2024-44997?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-44997?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-44997 being exploited?
There is no known exploitation of CVE-2024-44997 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-48741, BELL-CVE-2024-44997, DEBIAN-CVE-2024-44997, GHSA-2jrr-ff5x-5jqg, UBUNTU-CVE-2024-44997.