In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: always wait for both firmware loading attempts In 'rtw_wait_firmware_completion()', always wait for both (regular and wowlan) firmware loading attempts. Otherwise if 'rtw_usb_intf_init()' has failed in 'rtw_usb_probe()', 'rtw_usb_disconnect()' may issue 'ieee80211_free_hw()' when one of 'rtw_load_firmware_cb()' (usually the wowlan one) is still in progress, causing UAF detected by KASAN.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://git.kernel.org/stable/c/0e735a4c6137262bcefe45bb52fde7b1f5fc6c4d cve-icon cve-icon
https://git.kernel.org/stable/c/1b8178a2ae272256ea0dc4f940320a81003535e2 cve-icon cve-icon
https://git.kernel.org/stable/c/7887ad11995a4142671cc49146db536f923c8568 cve-icon cve-icon
https://git.kernel.org/stable/c/9432185540bafd42b7bfac6e6ef2f0a0fb4be447 cve-icon cve-icon
https://git.kernel.org/stable/c/a0c1e2da652cf70825739bc12d49ea15805690bf cve-icon cve-icon
https://git.kernel.org/stable/c/ceaab3fb64d6a5426a3db8f87f3e5757964f2532 cve-icon cve-icon
https://git.kernel.org/stable/c/e9a78d9417e167410d6fb83c4e908b077ad8ba6d cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024102121-CVE-2024-47718-c7cd@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-47718 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-47718 cve-icon
History

Thu, 24 Oct 2024 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Weaknesses CWE-416
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Tue, 22 Oct 2024 01:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Mon, 21 Oct 2024 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 21 Oct 2024 12:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: always wait for both firmware loading attempts In 'rtw_wait_firmware_completion()', always wait for both (regular and wowlan) firmware loading attempts. Otherwise if 'rtw_usb_intf_init()' has failed in 'rtw_usb_probe()', 'rtw_usb_disconnect()' may issue 'ieee80211_free_hw()' when one of 'rtw_load_firmware_cb()' (usually the wowlan one) is still in progress, causing UAF detected by KASAN.
Title wifi: rtw88: always wait for both firmware loading attempts
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-10-21T11:53:48.859Z

Updated: 2024-11-05T09:49:23.576Z

Reserved: 2024-09-30T16:00:12.949Z

Link: CVE-2024-47718

cve-icon Vulnrichment

Updated: 2024-10-21T13:02:26.331Z

cve-icon NVD

Status : Analyzed

Published: 2024-10-21T12:15:08.090

Modified: 2024-10-24T16:31:01.107

Link: CVE-2024-47718

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-10-21T00:00:00Z

Links: CVE-2024-47718 - Bugzilla