CVE-2024-49938 wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
A flaw in the ath9k_htc Wi-Fi driver allows a local attacker to cause a denial of service via uninitialized memory access during USB error handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-49938?
CVE-2024-49938 is a medium-severity vulnerability in Linux kernel, published on 21 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
Syzbot points out that skb_trim() has a sanity check on the existing length of the skb, which can be uninitialised in some error paths. The intent here is clearly just to reset the length to zero before resubmitting, so switch to calling __skb_set_length(skb, 0) directly. In addition, __skb_set_length() already contains a call to skb_reset_tail_pointer(), so remove the redundant call.
The syzbot report came from ath9k_hif_usb_reg_in_cb(), but there's a similar usage of skb_trim() in ath9k_hif_usb_rx_cb(), change both while we're at it.
Weakness: CWE-824
Which versions are affected by CVE-2024-49938?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-49938?
Apply the vendor's patch.
Is CVE-2024-49938 being exploited?
There is no known exploitation of CVE-2024-49938 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-52902, BELL-CVE-2024-49938, DEBIAN-CVE-2024-49938, GHSA-hpqg-3xxv-rhj6, UBUNTU-CVE-2024-49938.