CVE-2024-40941: wifi: iwlwifi: mvm: don't read past the mfuart notifcation
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: don't read past the mfuart notifcation
In case the firmware sends a notification that claims it has more data than it has, we will read past that was allocated for the notification. Remove the print of the buffer, we won't see it by default. If needed, we can see the content with tracing.
This was reported by KFENCE.
Other sources
Linux Kernel is vulnerable to a denial of service, caused by a flaw in iwlwifi/mvm/fw.c . A local authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40941?
CVE-2024-40941 has a high severity rating due to its potential for memory corruption leading to system instability.
How do I fix CVE-2024-40941?
To fix CVE-2024-40941, update to the latest kernel versions provided by your distribution, such as 4.19.317, 5.4.279, or 6.10.
What systems are affected by CVE-2024-40941?
CVE-2024-40941 affects various distributions of the Linux kernel, specifically those prior to the specified remedied versions.
Can CVE-2024-40941 be exploited remotely?
CVE-2024-40941 could potentially be exploited remotely if an attacker can send crafted notifications to a vulnerable system.
Is there a workaround for CVE-2024-40941?
There is no known workaround for CVE-2024-40941; applying the patch or upgrading the kernel is necessary to mitigate the risk.