Lucene search

K
osvGoogleOSV:CVE-2024-46672
HistorySep 11, 2024 - 4:15 p.m.

CVE-2024-46672

2024-09-1116:15:07
Google
osv.dev
linux kernel
wifi vulnerability
ssid based pmksa deletion
brcmfmac
cfg80211
wpa_supplicant 2.11
pmksa flush
sae/owe offload
pmksa del commands
bssid
pmkid pointers
pmkid_v3 operations
software

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.8

Confidence

Low

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion

wpa_supplicant 2.11 sends since 1efdba5fdc2c (“Handle PMKSA flush in the
driver for SAE/OWE offload cases”) SSID based PMKSA del commands.
brcmfmac is not prepared and tries to dereference the NULL bssid and
pmkid pointers in cfg80211_pmksa. PMKID_V3 operations support SSID based
updates so copy the SSID.

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.8

Confidence

Low

Related for OSV:CVE-2024-46672