CVE-2024-40941 wifi: iwlwifi: mvm: don't read past the mfuart notifcation

2024-07-1212:25:16

Linux

www.cve.org

linux kernel

wifi vulnerability

resolution

cve-2024-40941

iwlwifi

kfence

mvm

mfuart notifcation

firmware

EPSS

Percentile

13.4%

JSON

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: don’t read past the mfuart notifcation

In case the firmware sends a notification that claims it has more data
than it has, we will read past that was allocated for the notification.
Remove the print of the buffer, we won’t see it by default. If needed,
we can see the content with tracing.

This was reported by KFENCE.

CNA Affected

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/net/wireless/intel/iwlwifi/mvm/fw.c"
    ],
    "versions": [
      {
        "version": "bdccdb854f2f",
        "lessThan": "15b37c6fab9d",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "bdccdb854f2f",
        "lessThan": "6532f18e66b3",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "bdccdb854f2f",
        "lessThan": "46c59a253370",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "bdccdb854f2f",
        "lessThan": "65686118845d",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "bdccdb854f2f",
        "lessThan": "a8bc8276af9a",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "bdccdb854f2f",
        "lessThan": "a05018739a5e",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "bdccdb854f2f",
        "lessThan": "acdfa33c3cf5",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "bdccdb854f2f",
        "lessThan": "4bb95f453548",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/net/wireless/intel/iwlwifi/mvm/fw.c"
    ],
    "versions": [
      {
        "version": "4.12",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "4.12",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "4.19.317",
        "lessThanOrEqual": "4.19.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.4.279",
        "lessThanOrEqual": "5.4.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.10.221",
        "lessThanOrEqual": "5.10.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.15.162",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.1.95",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.6.35",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.9.6",
        "lessThanOrEqual": "6.9.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.10",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]