CVE-2024-58072: wifi: rtlwifi: remove unused check_buddy_priv
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtlwifi: remove unused checkbuddypriv
Commit 2461c7d60f9f ("rtlwifi: Update header file") introduced a global list of private data structures.
Later on, commit 26634c4b1868 ("rtlwifi Modify existing bits to match vendor version 2013.02.07") started adding the private data to that list at probe time and added a hook, checkbuddypriv to find the private data from a similar device.
However, that function was never used.
Besides, though there is a lock for that list, it is never used. And when the probe fails, the private data is never removed from the list. This would cause a second probe to access freed memory.
Remove the unused hook, structures and members, which will prevent the potential race condition on the list and its corruption during a second probe when probe fails.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Linux kernel rtlwifi (check_buddy_priv)from your environment.Remove the unused hook, structures and members related to check_buddy_priv in rtlwifi to prevent a race condition on the list and its corruption (as described by committing “wifi: rtlwifi: remove unused check_buddy_priv”).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58072?
CVE-2024-58072 is classified as a low-severity vulnerability due to the removal of an unused check in the kernel.
How do I fix CVE-2024-58072?
To fix CVE-2024-58072, ensure that your Linux kernel is updated to the latest version that includes the relevant patches.
What versions of the Linux kernel are affected by CVE-2024-58072?
CVE-2024-58072 affects specific versions of the Linux kernel where the rtlwifi driver is implemented.
Is CVE-2024-58072 exploitable remotely?
CVE-2024-58072 has a minimal risk of remote exploitation due to its nature as a low-priority code change.
What components are related to CVE-2024-58072?
CVE-2024-58072 is related to the rtlwifi driver within the Linux kernel.