CVE-2024-35912: wifi: iwlwifi: mvm: rfi: fix potential response leaks
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: rfi: fix potential response leaks
If the rx payload length check fails, or if kmemdup() fails, we still need to free the command response. Fix that.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: rfi: fix potential response leaks
The Linux kernel CVE team has assigned CVE-2024-35912 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051956-CVE-2024-35912-b093@gregkh/T
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by a response leaks when the rx payload length check fails, or if kmemdup() fails. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35912?
CVE-2024-35912 has been rated with a moderate severity level due to potential response leaks in the Linux kernel.
How do I fix CVE-2024-35912?
To fix CVE-2024-35912, update the kernel to versions 5.15.154, 6.1.85, 6.6.26, 6.8.5, 6.9, or specific Debian versions listed.
Which Linux kernel versions are affected by CVE-2024-35912?
CVE-2024-35912 affects Linux kernel versions prior to 5.15.154, 6.1.85, 6.6.26, 6.8.5, and 6.9.
What type of vulnerability is CVE-2024-35912?
CVE-2024-35912 is a response leak vulnerability related to the iwlwifi driver in the Linux kernel.
Can CVE-2024-35912 be exploited remotely?
Yes, CVE-2024-35912 could potentially be exploited in a manner that allows remote attackers to affect the system behavior.