CVE-2024-46760 wifi: rtw88: usb: schedule rx work after everything is set up
A race condition in the rtw88 USB WiFi driver causes a NULL pointer dereference, leading to a kernel crash and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-46760?
CVE-2024-46760 is a medium-severity vulnerability in Linux kernel, published on 18 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw88: usb: schedule rx work after everything is set up
Right now it's possible to hit NULL pointer dereference in rtw_rx_fill_rx_status on hw object and/or its fields because initialization routine can start getting USB replies before rtw_dev is fully setup.
The stack trace looks like this:
rtw_rx_fill_rx_status rtw8821c_query_rx_desc rtw_usb_rx_handler ... queue_work rtw_usb_read_port_complete ... usb_submit_urb rtw_usb_rx_resubmit rtw_usb_init_rx rtw_usb_probe
So while we do the async stuff rtw_usb_probe continues and calls rtw_register_hw, which does all kinds of initialization (e.g. via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.
Fix this by moving the first usb_submit_urb after everything is set up.
For me, this bug manifested as: [ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped [ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_status because I'm using Larry's backport of rtw88 driver with the NULL checks in rtw_rx_fill_rx_status.
Weakness: CWE-476
Which versions are affected by CVE-2024-46760?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-46760?
Apply the vendor's patch.
Is CVE-2024-46760 being exploited?
There is no known exploitation of CVE-2024-46760 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-49557, BELL-CVE-2024-46760, DEBIAN-CVE-2024-46760, GHSA-6vq9-c7rm-r447, ROOT-OS-DEBIAN-11-CVE-2024-46760, ROOT-OS-DEBIAN-12-CVE-2024-46760 and 1 more.