CVE-2024-47721

CVE-2024-47721 affects the Linux kernel’s RTW89 Wi-Fi driver. The vulnerability stemmed from an unimplemented firmware C2H event RTW89_MAC_C2H_FUNC_READ_WOW_CAM, while the driver counted handlers using NUM_OF_RTW89_MAC_C2H_FUNC_WOW, causing out-of-bounds reads. The issue is resolved by removing t...

CVE-2024-47721 wifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: remove unused C2H event ID RTW89MACC2HFUNCREADWOWCAM to prevent out-of-bounds reading The handler of firmware C2H event RTW89MACC2HFUNCREADWOWCAM isn't implemented, but driver expects number of handlers is...

CVE-2024-47721 wifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: remove unused C2H event ID RTW89MACC2HFUNCREADWOWCAM to prevent out-of-bounds reading The handler of firmware C2H event RTW89MACC2HFUNCREADWOWCAM isn't implemented, but driver expects number of handlers is...

CVE-2024-47721

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: remove unused C2H event ID RTW89MACC2HFUNCREADWOWCAM to prevent out-of-bounds reading The handler of firmware C2H event RTW89MACC2HFUNCREADWOWCAM isn't implemented, but driver expects number of handlers is...

CVE-2024-47721 wifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: remove unused C2H event ID RTW89MACC2HFUNCREADWOWCAM to prevent out-of-bounds reading The handler of firmware C2H event RTW89MACC2HFUNCREADWOWCAM isn't implemented, but driver expects number of handlers is...

CVE-2024-47718 wifi: rtw88: always wait for both firmware loading attempts

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: always wait for both firmware loading attempts In 'rtwwaitfirmwarecompletion', always wait for both regular and wowlan firmware loading attempts. Otherwise if 'rtwusbintfinit' has failed in 'rtwusbprobe',...

CVE-2024-47718 wifi: rtw88: always wait for both firmware loading attempts

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: always wait for both firmware loading attempts In 'rtwwaitfirmwarecompletion', always wait for both regular and wowlan firmware loading attempts. Otherwise if 'rtwusbintfinit' has failed in 'rtwusbprobe',...

CVE-2024-47718

CVE-2024-47718 affects the Linux kernel wireless stack (rtw88) used by the wifi subsystem. The issue arises in wifi: rtw88 where firmware loading requires two attempts (regular and wowlan). In rtw_wait_firmware_completion(), the code now always waits for both attempts; previously, if rtw_usb_intf...

CVE-2024-47718 wifi: rtw88: always wait for both firmware loading attempts

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: always wait for both firmware loading attempts In 'rtwwaitfirmwarecompletion', always wait for both regular and wowlan firmware loading attempts. Otherwise if 'rtwusbintfinit' has failed in 'rtwusbprobe',...

CVE-2024-47718

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: always wait for both firmware loading attempts In 'rtwwaitfirmwarecompletion', always wait for both regular and wowlan firmware loading attempts. Otherwise if 'rtwusbintfinit' has failed in 'rtwusbprobe',...

CVE-2024-47715

Summary: CVE-2024-47715 affects the Linux kernel’s wifi mt76 driver for MT7915 on MT7986. The issue stemmed from mt7915_band_config() setting band_idx to 1 on the main phy for MT7986 with MT7975_ONE_ADIE or MT7976_ONE_ADIE, which caused a dereference of the phys array via wcid->phy_idx in mt76...

CVE-2024-47714

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: use hweight16 to get correct tx antenna The chainmask is u16 so using hweight8 cannot get correct txant. Without this patch, the txant of band 2 would be -1 and lead to the following issue: BUG: KASAN:...

CVE-2024-47714 wifi: mt76: mt7996: use hweight16 to get correct tx antenna

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: use hweight16 to get correct tx antenna The chainmask is u16 so using hweight8 cannot get correct txant. Without this patch, the txant of band 2 would be -1 and lead to the following issue: BUG: KASAN:...

CVE-2024-47714 wifi: mt76: mt7996: use hweight16 to get correct tx antenna

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: use hweight16 to get correct tx antenna The chainmask is u16 so using hweight8 cannot get correct txant. Without this patch, the txant of band 2 would be -1 and lead to the following issue: BUG: KASAN:...

CVE-2024-47714 wifi: mt76: mt7996: use hweight16 to get correct tx antenna

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: use hweight16 to get correct tx antenna The chainmask is u16 so using hweight8 cannot get correct txant. Without this patch, the txant of band 2 would be -1 and lead to the following issue: BUG: KASAN:...

CVE-2024-47714

CVE-2024-47714 affects the Linux kernel Wi-Fi driver for MT76/MT7996. The root cause is using hweight8 on a u16 chainmask, which yields an incorrect tx_ant; a patch switches to hweight16 to compute the correct tx antenna. Without the fix, tx_ant on band 2 could be -1, leading to a KASAN: stack-ou...

CVE-2024-47715 wifi: mt76: mt7915: fix oops on non-dbdc mt7986

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix oops on non-dbdc mt7986 mt7915bandconfig sets bandidx = 1 on the main phy for mt7986 with MT7975ONEADIE or MT7976ONEADIE. Commit 0335c034e726 "wifi: mt76: fix race condition related to checking tx queue fi...

CVE-2024-47713 wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use two-phase skb reclamation in ieee80211dostop Since 'devqueuexmit' should be called with interrupts enabled, the following backtrace: ieee80211dostop ... spinlockirqsave&local-queuestopreasonlock, flags...

CVE-2024-47713

CVE-2024-47713 is a Linux kernel vulnerability in wifi/mac80211: two-phase skb reclamation is needed in ieee80211_do_stop to ensure work is done with interrupts enabled. The patch moves the actual skb work outside the IRQ-disabled region to avoid warning and potential issues when backtracing thro...

CVE-2024-47713 wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use two-phase skb reclamation in ieee80211dostop Since 'devqueuexmit' should be called with interrupts enabled, the following backtrace: ieee80211dostop ... spinlockirqsave&local-queuestopreasonlock, flags...