In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw88: always wait for both firmware loading attempts
In 'rtwwaitfirmwarecompletion()', always wait for both (regular and wowlan) firmware loading attempts. Otherwise if 'rtwusbintfinit()' has failed in 'rtwusbprobe()', 'rtwusbdisconnect()' may issue 'ieee80211freehw()' when one of 'rtwloadfirmware_cb()' (usually the wowlan one) is still in progress, causing UAF detected by KASAN.
[ { "signature_type": "Function", "id": "CVE-2024-47718-012f4b08", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e735a4c6137262bcefe45bb52fde7b1f5fc6c4d", "signature_version": "v1", "target": { "function": "rtw_wait_firmware_completion", "file": "drivers/net/wireless/realtek/rtw88/main.c" }, "digest": { "function_hash": "196667861365858665955307364238290292185", "length": 338.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-47718-071425a0", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ceaab3fb64d6a5426a3db8f87f3e5757964f2532", "signature_version": "v1", "target": { "function": "rtw_wait_firmware_completion", "file": "drivers/net/wireless/realtek/rtw88/main.c" }, "digest": { "function_hash": "72944630957404735747883596325166755250", "length": 332.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-47718-0a9e76db", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b8178a2ae272256ea0dc4f940320a81003535e2", "signature_version": "v1", "target": { "function": "rtw_wait_firmware_completion", "file": "drivers/net/wireless/realtek/rtw88/main.c" }, "digest": { "function_hash": "196667861365858665955307364238290292185", "length": 338.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-47718-0b9e0156", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0c1e2da652cf70825739bc12d49ea15805690bf", "signature_version": "v1", "target": { "file": "drivers/net/wireless/realtek/rtw88/main.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "94982010669187314088375515948729000512", "246685985348606002344553051710899306297", "209972768354462552098615897719981931005", "121011799127839724315028575999408356395", "259685917247365490641528997928212026204", "318053371549291180883867367604308203219", "306962224796082473061159709069363423464", "200713876913588556466502966398289641986", "32926130522751812325468295230180381078", "52764394025680827730400648269141303241", "44610494863238578409645063806401356022", "175610523346826988210675464617245893367", "298176824356441214070682504711865561728", "163453338493463777843037430742199497197", "46916378211579936122405384483192386912" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-47718-0d4bb8f0", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e735a4c6137262bcefe45bb52fde7b1f5fc6c4d", "signature_version": "v1", "target": { "file": "drivers/net/wireless/realtek/rtw88/main.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "7267067328745849294174193810611174929", "145640459210158259781548703905843794716", "75976882431289306641873008608621152383", "121011799127839724315028575999408356395", "259685917247365490641528997928212026204", "318053371549291180883867367604308203219", "306962224796082473061159709069363423464", "200713876913588556466502966398289641986", "32926130522751812325468295230180381078", "52764394025680827730400648269141303241", "44610494863238578409645063806401356022", "175610523346826988210675464617245893367", "298176824356441214070682504711865561728", "141971521316081135334685629508528886951", "236688887977534002214688835398596806761" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-47718-1be74ea9", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ceaab3fb64d6a5426a3db8f87f3e5757964f2532", "signature_version": "v1", "target": { "file": "drivers/net/wireless/realtek/rtw88/main.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "94982010669187314088375515948729000512", "246685985348606002344553051710899306297", "209972768354462552098615897719981931005", "121011799127839724315028575999408356395", "259685917247365490641528997928212026204", "318053371549291180883867367604308203219", "306962224796082473061159709069363423464", "200713876913588556466502966398289641986", "32926130522751812325468295230180381078", "52764394025680827730400648269141303241", "44610494863238578409645063806401356022", "175610523346826988210675464617245893367", "298176824356441214070682504711865561728", "141971521316081135334685629508528886951", "236688887977534002214688835398596806761" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-47718-309ad179", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9432185540bafd42b7bfac6e6ef2f0a0fb4be447", "signature_version": "v1", "target": { "file": "drivers/net/wireless/realtek/rtw88/main.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "7267067328745849294174193810611174929", "145640459210158259781548703905843794716", "75976882431289306641873008608621152383", "121011799127839724315028575999408356395", "259685917247365490641528997928212026204", "318053371549291180883867367604308203219", "306962224796082473061159709069363423464", "200713876913588556466502966398289641986", "32926130522751812325468295230180381078", "52764394025680827730400648269141303241", "44610494863238578409645063806401356022", "175610523346826988210675464617245893367", "298176824356441214070682504711865561728", "141971521316081135334685629508528886951", "236688887977534002214688835398596806761" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-47718-41dea409", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7887ad11995a4142671cc49146db536f923c8568", "signature_version": "v1", "target": { "file": "drivers/net/wireless/realtek/rtw88/main.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "7267067328745849294174193810611174929", "145640459210158259781548703905843794716", "75976882431289306641873008608621152383", "121011799127839724315028575999408356395", "259685917247365490641528997928212026204", "318053371549291180883867367604308203219", "306962224796082473061159709069363423464", "200713876913588556466502966398289641986", "32926130522751812325468295230180381078", "52764394025680827730400648269141303241", "44610494863238578409645063806401356022", "175610523346826988210675464617245893367", "298176824356441214070682504711865561728", "141971521316081135334685629508528886951", "236688887977534002214688835398596806761" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-47718-43d5d8aa", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9a78d9417e167410d6fb83c4e908b077ad8ba6d", "signature_version": "v1", "target": { "file": "drivers/net/wireless/realtek/rtw88/main.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "7267067328745849294174193810611174929", "145640459210158259781548703905843794716", "75976882431289306641873008608621152383", "121011799127839724315028575999408356395", "259685917247365490641528997928212026204", "318053371549291180883867367604308203219", "306962224796082473061159709069363423464", "200713876913588556466502966398289641986", "32926130522751812325468295230180381078", "52764394025680827730400648269141303241", "44610494863238578409645063806401356022", "175610523346826988210675464617245893367", "298176824356441214070682504711865561728", "141971521316081135334685629508528886951", "236688887977534002214688835398596806761" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-47718-88e6282a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9a78d9417e167410d6fb83c4e908b077ad8ba6d", "signature_version": "v1", "target": { "function": "rtw_wait_firmware_completion", "file": "drivers/net/wireless/realtek/rtw88/main.c" }, "digest": { "function_hash": "196667861365858665955307364238290292185", "length": 338.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-47718-a08c8571", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b8178a2ae272256ea0dc4f940320a81003535e2", "signature_version": "v1", "target": { "file": "drivers/net/wireless/realtek/rtw88/main.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "7267067328745849294174193810611174929", "145640459210158259781548703905843794716", "75976882431289306641873008608621152383", "121011799127839724315028575999408356395", "259685917247365490641528997928212026204", "318053371549291180883867367604308203219", "306962224796082473061159709069363423464", "200713876913588556466502966398289641986", "32926130522751812325468295230180381078", "52764394025680827730400648269141303241", "44610494863238578409645063806401356022", "175610523346826988210675464617245893367", "298176824356441214070682504711865561728", "141971521316081135334685629508528886951", "236688887977534002214688835398596806761" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-47718-ba1744ef", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0c1e2da652cf70825739bc12d49ea15805690bf", "signature_version": "v1", "target": { "function": "rtw_wait_firmware_completion", "file": "drivers/net/wireless/realtek/rtw88/main.c" }, "digest": { "function_hash": "72944630957404735747883596325166755250", "length": 332.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-47718-f528f777", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9432185540bafd42b7bfac6e6ef2f0a0fb4be447", "signature_version": "v1", "target": { "function": "rtw_wait_firmware_completion", "file": "drivers/net/wireless/realtek/rtw88/main.c" }, "digest": { "function_hash": "196667861365858665955307364238290292185", "length": 338.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-47718-faebce1a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7887ad11995a4142671cc49146db536f923c8568", "signature_version": "v1", "target": { "function": "rtw_wait_firmware_completion", "file": "drivers/net/wireless/realtek/rtw88/main.c" }, "digest": { "function_hash": "196667861365858665955307364238290292185", "length": 338.0 }, "deprecated": false } ]