CVE-2024-27049 wifi: mt76: mt7925e: fix use-after-free in free_irq()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925e: fix use-after-free in freeirq From commit a304e1b82808 "PATCH Debug shared irqs", there is a test to make sure the shared irq handler should be able to handle the unexpected event after deregistration. For th...

CVE-2024-27049

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925e: fix use-after-free in freeirq From commit a304e1b82808 "PATCH Debug shared irqs", there is a test to make sure the shared irq handler should be able to handle the unexpected event after deregistration. For th...

CVE-2024-27049 wifi: mt76: mt7925e: fix use-after-free in free_irq()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925e: fix use-after-free in freeirq From commit a304e1b82808 "PATCH Debug shared irqs", there is a test to make sure the shared irq handler should be able to handle the unexpected event after deregistration. For th...

CVE-2024-27048

CVE-2024-27048 : Linux kernel wifi (brcm80211) vulnerability where kzalloc() may return NULL for pmk_op, risking a NULL dereference. The fix returns -ENOMEM from brcmf_pmksa_v3_op() when kzalloc() fails for pmk_op, mitigating local-exploit risk. Connected advisories ( MiracleLinux AXSA and IBM li...

CVE-2024-27048 wifi: brcm80211: handle pmk_op allocation failure

In the Linux kernel, the following vulnerability has been resolved: wifi: brcm80211: handle pmkop allocation failure The kzalloc in brcmfpmksav3op will return null if the physical memory has run out. As a result, if we dereference the null value, the null pointer dereference bug will happen. Retu...

CVE-2024-27048 wifi: brcm80211: handle pmk_op allocation failure

In the Linux kernel, the following vulnerability has been resolved: wifi: brcm80211: handle pmkop allocation failure The kzalloc in brcmfpmksav3op will return null if the physical memory has run out. As a result, if we dereference the null value, the null pointer dereference bug will happen. Retu...

CVE-2024-27048 wifi: brcm80211: handle pmk_op allocation failure

In the Linux kernel, the following vulnerability has been resolved: wifi: brcm80211: handle pmkop allocation failure The kzalloc in brcmfpmksav3op will return null if the physical memory has run out. As a result, if we dereference the null value, the null pointer dereference bug will happen. Retu...

CVE-2024-27048

In the Linux kernel, the following vulnerability has been resolved: wifi: brcm80211: handle pmkop allocation failure The kzalloc in brcmfpmksav3op will return null if the physical memory has run out. As a result, if we dereference the null value, the null pointer dereference bug will happen. Retu...

Important: Red Hat Security Advisory: linux-firmware security update

An update for linux-firmware is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Red Hat Product Security has rated this upda...

kernel: wifi: mac80211: don't return unset power in ieee80211_get_tx_power()

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't return unset power in ieee80211gettxpower We can get a UBSAN warning if ieee80211gettxpower returns the INTMIN value mac80211 internally uses for "unset power level". UBSAN: signed-integer-overflow in...

kernel: wifi: mac80211_hwsim: Fix possible NULL dereference

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: Fix possible NULL dereference In a call to mac80211hwsimselecttxlink the sta pointer might be NULL, thus need to check that it is not NULL before accessing it...

kernel: wifi: mac80211_hwsim: drop short frames

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: drop short frames While technically some control frames like ACK are shorter and end after Address 1, such frames shouldn't be forwarded through wmediumd or similar userspace, so require the full 3-address...

kernel: wifi: fix registration of 6Ghz-only phy without the full channel range

A flaw was found in the Linux kernel ath11k Wi-Fi driver’s channel range validation logic. When registering a 6 GHz-only physical device whose board data does not allow a specific 7.115 GHz channel, the driver incorrectly handles the channel range, causing the phy to fail registration. This...

CVE-2024-4250

A vulnerability was found in Tenda i21 1.0.0.144656. It has been declared as critical. Affected by this vulnerability is the function formwrlSSIDset of the file /goform/wifiSSIDset. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack can be launched remotel...

PT-2024-3254 · Tenda · Tenda I21

Name of the Vulnerable Software and Affected Versions: Tenda i21 version 1.0.0.144656 Description: A critical issue is related to the function formWifiMacFilterGet and is caused by a stack-based buffer overflow when handling the index parameter. This can be exploited remotely by sending a special...

The vulnerability of the setWiFiExtenderConfig function in TOTOLINK EX200 router microprogramming software allows a attacker to perform XSS attacks.

The vulnerability of the setWiFiExtenderConfig function in TOTOLINK EX200 router microprogramming software exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2024-4127

A vulnerability was found in Tenda W15E 15.11.0.14. It has been classified as critical. Affected is the function guestWifiRuleRefresh. The manipulation of the argument qosGuestDownstream leads to stack-based buffer overflow. It is possible to launch the attack remotely. VDB-261870 is the identifi...

CVE-2024-4127

A vulnerability was found in Tenda W15E 15.11.0.14. It has been classified as critical. Affected is the function guestWifiRuleRefresh. The manipulation of the argument qosGuestDownstream leads to stack-based buffer overflow. It is possible to launch the attack remotely. VDB-261870 is the identifi...

CVE-2024-4127

CVE-2024-4127 affects the Tenda W15E firmware 15.11.0.14. The vulnerability lies in the function guestWifiRuleRefresh , where manipulation of the argument qosGuestDownstream causes a stack-based buffer overflow. This condition can be exploited remotely, per the CVE description and multiple connec...

Tenda W15E 安全漏洞

Shenzhen Jixiang Tengda Technology Co., Ltd W15E is a wireless router. A security vulnerability exists in Shenzhen Jixiang Tengda Technology Co., Ltd W15E version 15.11.0.14, which stems from a buffer overflow vulnerability in the qosGuestDownstream parameter of the guestWifiRuleRefresh method. N...