CVE-2024-41071: wifi: mac80211: Avoid address calculations via out of bounds array indexing
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: Avoid address calculations via out of bounds array indexing
req->nchannels must be set before req->channels[] can be used.
This patch fixes one of the issues encountered in [1].
[ 83.964255] UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:364:4 [ 83.964258] index 0 is out of range for type 'struct ieee80211channel []' [...] [ 83.964264] Call Trace: [ 83.964267] <TASK> [ 83.964269] dumpstacklvl+0x3f/0xc0 [ 83.964274] ubsanhandleoutofbounds+0xec/0x110 [ 83.964278] ieee80211prephwscan+0x2db/0x4b0 [ 83.964281] ieee80211startscan+0x601/0x990 [ 83.964291] nl80211triggerscan+0x874/0x980 [ 83.964295] genlfamilyrcvmsgdoit+0xe8/0x160 [ 83.964298] genlrcvmsg+0x240/0x270 [...]
[1] https://bugzilla.kernel.org/showbug.cgi?id=218810
Other sources
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
— NVD
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41071?
CVE-2024-41071 has been classified with a severity rating that indicates it affects the integrity of the Linux kernel's memory management.
How do I fix CVE-2024-41071?
To resolve CVE-2024-41071, upgrade to the patched versions of the Linux kernel as specified for your distribution.
Which Linux kernel versions are affected by CVE-2024-41071?
CVE-2024-41071 impacts Linux kernel versions below 6.9.11 and certain earlier Debian kernel versions.
What type of vulnerability is CVE-2024-41071?
CVE-2024-41071 is a vulnerability in the Linux kernel's mac80211 subsystem related to out-of-bounds array indexing.
Who issued the patch for CVE-2024-41071?
The patch for CVE-2024-41071 was issued by the maintainers of the Linux kernel in response to identified security issues.