In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: don't read past the mfuart notifcation
In case the firmware sends a notification that claims it has more data than it has, we will read past that was allocated for the notification. Remove the print of the buffer, we won't see it by default. If needed, we can see the content with tracing.
This was reported by KFENCE.
[
{
"digest": {
"function_hash": "43329113736630689129427196983629341061",
"length": 521.0
},
"id": "CVE-2024-40941-0d9e7b11",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8bc8276af9aeacabb773f0c267cfcdb847c6f2d",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/intel/iwlwifi/mvm/fw.c",
"function": "iwl_mvm_mfu_assert_dump_notif"
},
"deprecated": false
},
{
"digest": {
"function_hash": "43329113736630689129427196983629341061",
"length": 521.0
},
"id": "CVE-2024-40941-18a21f34",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@acdfa33c3cf5e1cd185cc1e0486bd0ea9f09c154",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/intel/iwlwifi/mvm/fw.c",
"function": "iwl_mvm_mfu_assert_dump_notif"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"145394435199501572726239359186422954493",
"127064106184092801986110963635816381419",
"194390108464726759996374380386846921216",
"260220325738904995572194675667219490346",
"75635029124642987146782376119301624226",
"69284123095648112729833722516481264224",
"33479416079860266877483979831329693195",
"138016420393047965897673001750234065497",
"274087206880814559884336443368985657167",
"64657124828702574452480728092198364200",
"308317568337763085033756383924982778332",
"276520131905512051342994770820139723117",
"112134725821730328032138416236926361042",
"56390570878796361786633377636215030938",
"111059185059420328761678028285628902154"
]
},
"id": "CVE-2024-40941-24f28350",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@acdfa33c3cf5e1cd185cc1e0486bd0ea9f09c154",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/intel/iwlwifi/mvm/fw.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "43329113736630689129427196983629341061",
"length": 521.0
},
"id": "CVE-2024-40941-48b33908",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46c59a25337049a2a230ce7f7c3b9f21d0aaaad7",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/intel/iwlwifi/mvm/fw.c",
"function": "iwl_mvm_mfu_assert_dump_notif"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"145394435199501572726239359186422954493",
"127064106184092801986110963635816381419",
"194390108464726759996374380386846921216",
"260220325738904995572194675667219490346",
"75635029124642987146782376119301624226",
"69284123095648112729833722516481264224",
"33479416079860266877483979831329693195",
"138016420393047965897673001750234065497",
"274087206880814559884336443368985657167",
"64657124828702574452480728092198364200",
"308317568337763085033756383924982778332",
"276520131905512051342994770820139723117",
"112134725821730328032138416236926361042",
"56390570878796361786633377636215030938",
"111059185059420328761678028285628902154"
]
},
"id": "CVE-2024-40941-56f49241",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6532f18e66b384b8d4b7e5c9caca042faaa9e8de",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/intel/iwlwifi/mvm/fw.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "43329113736630689129427196983629341061",
"length": 521.0
},
"id": "CVE-2024-40941-6577e698",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15b37c6fab9d5e40ac399fa1c725118588ed649c",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/intel/iwlwifi/mvm/fw.c",
"function": "iwl_mvm_mfu_assert_dump_notif"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"145394435199501572726239359186422954493",
"127064106184092801986110963635816381419",
"194390108464726759996374380386846921216",
"260220325738904995572194675667219490346",
"75635029124642987146782376119301624226",
"69284123095648112729833722516481264224",
"33479416079860266877483979831329693195",
"138016420393047965897673001750234065497",
"274087206880814559884336443368985657167",
"64657124828702574452480728092198364200",
"308317568337763085033756383924982778332",
"276520131905512051342994770820139723117",
"112134725821730328032138416236926361042",
"56390570878796361786633377636215030938",
"111059185059420328761678028285628902154"
]
},
"id": "CVE-2024-40941-6b8fc8bb",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65686118845d427df27ee83a6ddd4885596b0805",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/intel/iwlwifi/mvm/fw.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"145394435199501572726239359186422954493",
"127064106184092801986110963635816381419",
"194390108464726759996374380386846921216",
"260220325738904995572194675667219490346",
"75635029124642987146782376119301624226",
"69284123095648112729833722516481264224",
"33479416079860266877483979831329693195",
"138016420393047965897673001750234065497",
"274087206880814559884336443368985657167",
"64657124828702574452480728092198364200",
"308317568337763085033756383924982778332",
"276520131905512051342994770820139723117",
"112134725821730328032138416236926361042",
"56390570878796361786633377636215030938",
"111059185059420328761678028285628902154"
]
},
"id": "CVE-2024-40941-750fbdff",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15b37c6fab9d5e40ac399fa1c725118588ed649c",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/intel/iwlwifi/mvm/fw.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"145394435199501572726239359186422954493",
"127064106184092801986110963635816381419",
"194390108464726759996374380386846921216",
"260220325738904995572194675667219490346",
"75635029124642987146782376119301624226",
"69284123095648112729833722516481264224",
"33479416079860266877483979831329693195",
"138016420393047965897673001750234065497",
"274087206880814559884336443368985657167",
"64657124828702574452480728092198364200",
"308317568337763085033756383924982778332",
"276520131905512051342994770820139723117",
"112134725821730328032138416236926361042",
"56390570878796361786633377636215030938",
"111059185059420328761678028285628902154"
]
},
"id": "CVE-2024-40941-7e3cdb1e",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46c59a25337049a2a230ce7f7c3b9f21d0aaaad7",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/intel/iwlwifi/mvm/fw.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "43329113736630689129427196983629341061",
"length": 521.0
},
"id": "CVE-2024-40941-8ba1e2bf",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6532f18e66b384b8d4b7e5c9caca042faaa9e8de",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/intel/iwlwifi/mvm/fw.c",
"function": "iwl_mvm_mfu_assert_dump_notif"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"145394435199501572726239359186422954493",
"127064106184092801986110963635816381419",
"194390108464726759996374380386846921216",
"260220325738904995572194675667219490346",
"75635029124642987146782376119301624226",
"69284123095648112729833722516481264224",
"33479416079860266877483979831329693195",
"138016420393047965897673001750234065497",
"274087206880814559884336443368985657167",
"64657124828702574452480728092198364200",
"308317568337763085033756383924982778332",
"276520131905512051342994770820139723117",
"112134725821730328032138416236926361042",
"56390570878796361786633377636215030938",
"111059185059420328761678028285628902154"
]
},
"id": "CVE-2024-40941-de3bd7b4",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8bc8276af9aeacabb773f0c267cfcdb847c6f2d",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/intel/iwlwifi/mvm/fw.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "43329113736630689129427196983629341061",
"length": 521.0
},
"id": "CVE-2024-40941-ecb3da9c",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65686118845d427df27ee83a6ddd4885596b0805",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/intel/iwlwifi/mvm/fw.c",
"function": "iwl_mvm_mfu_assert_dump_notif"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"145394435199501572726239359186422954493",
"127064106184092801986110963635816381419",
"194390108464726759996374380386846921216",
"260220325738904995572194675667219490346",
"75635029124642987146782376119301624226",
"69284123095648112729833722516481264224",
"33479416079860266877483979831329693195",
"138016420393047965897673001750234065497",
"274087206880814559884336443368985657167",
"64657124828702574452480728092198364200",
"308317568337763085033756383924982778332",
"276520131905512051342994770820139723117",
"112134725821730328032138416236926361042",
"56390570878796361786633377636215030938",
"111059185059420328761678028285628902154"
]
},
"id": "CVE-2024-40941-f4d2b7c8",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a05018739a5e6b9dc112c95bd4c59904062c8940",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/intel/iwlwifi/mvm/fw.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "43329113736630689129427196983629341061",
"length": 521.0
},
"id": "CVE-2024-40941-fbed6f97",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a05018739a5e6b9dc112c95bd4c59904062c8940",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/intel/iwlwifi/mvm/fw.c",
"function": "iwl_mvm_mfu_assert_dump_notif"
},
"deprecated": false
}
]