CVE-2024-47738 wifi: mac80211: don't use rate mask for offchannel TX either
A flaw in the Linux kernel's mac80211 subsystem can cause warnings or potential instability during offchannel transmission due to incorrect rate mask handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47738?
CVE-2024-47738 is a low-severity denial of service vulnerability in Linux kernel, published on 21 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: don't use rate mask for offchannel TX either
Like the commit ab9177d83c04 ("wifi: mac80211: don't use rate mask for scanning"), ignore incorrect settings to avoid no supported rate warning reported by syzbot.
The syzbot did bisect and found cause is commit 9df66d5b9f45 ("cfg80211: fix default HE tx bitrate mask in 2G band"), which however corrects bitmask of HE MCS and recognizes correctly settings of empty legacy rate plus HE MCS rate instead of returning -EINVAL.
As suggestions [1], follow the change of SCAN TX to consider this case of offchannel TX as well.
[1] https://lore.kernel.org/linux-wireless/[email protected]/T/#m2ac2a6d2be06a37c9c47a3d8a44b4f647ed4f024
Which versions are affected by CVE-2024-47738?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-47738?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-47738 being exploited?
There is no known exploitation of CVE-2024-47738 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-50752, AZL-50930, BELL-CVE-2024-47738, DEBIAN-CVE-2024-47738, GHSA-8mgj-pm8q-9jpq, ROOT-OS-UBUNTU-2204-CVE-2024-47738 and 1 more.