In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: fix array out-of-bound access in SoC stats
Currently, the ath11ksocdpstats::halreoerror array is defined with a maximum size of DPREODSTRINGMAX. However, the ath11kdpprocessrx() function access ath11ksocdpstats::halreoerror using the REO destination SRNG ring ID, which is incorrect. SRNG ring ID differ from normal ring ID, and this usage leads to out-of-bounds array access. To fix this issue, modify ath11kdpprocessrx() to use the normal ring ID directly instead of the SRNG ring ID to avoid out-of-bounds array access.
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
[
{
"id": "CVE-2024-49930-17b1522f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f26f26944035ec67546a944f182cbad6577a9c0",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/ath11k/dp_rx.c",
"function": "ath11k_dp_process_rx"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 2569.0,
"function_hash": "199119859982963786230014780266586467620"
}
},
{
"id": "CVE-2024-49930-3040f73d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a552bc2f3efe2aaf77a85cb34cdf4a63d81a1a7",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/ath11k/dp_rx.c",
"function": "ath11k_dp_process_rx"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 2897.0,
"function_hash": "249205558426384909851536891838546079447"
}
},
{
"id": "CVE-2024-49930-73a5d0d2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@69f253e46af98af17e3efa3e5dfa72fcb7d1983d",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/ath11k/dp_rx.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"322444651299801484029435035027230363065",
"235315592489064000802182128623881804600",
"70754909493169619303423059166754925174",
"115524262893538124163787151140784075413"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-49930-7d6ddda9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73e235728e515faccc104b0153b47d0f263b3344",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/ath11k/dp_rx.c",
"function": "ath11k_dp_process_rx"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 2897.0,
"function_hash": "249205558426384909851536891838546079447"
}
},
{
"id": "CVE-2024-49930-8bac8636",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6045ef5b4b00fee3629689f791992900a1c94009",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/ath11k/dp_rx.c",
"function": "ath11k_dp_process_rx"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 2897.0,
"function_hash": "249205558426384909851536891838546079447"
}
},
{
"id": "CVE-2024-49930-97cb520f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f26f26944035ec67546a944f182cbad6577a9c0",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/ath11k/dp_rx.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"326387305052383178326936041729458556030",
"154052436673159362757616573624586264042",
"70754909493169619303423059166754925174",
"91530370800321678960412104677918252810"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-49930-a37bbadb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01b77f5ee11c89754fb836af8f76799d3b72ae2f",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/ath11k/dp_rx.c",
"function": "ath11k_dp_process_rx"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 2897.0,
"function_hash": "249205558426384909851536891838546079447"
}
},
{
"id": "CVE-2024-49930-b28dbb1d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a552bc2f3efe2aaf77a85cb34cdf4a63d81a1a7",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/ath11k/dp_rx.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"322444651299801484029435035027230363065",
"235315592489064000802182128623881804600",
"70754909493169619303423059166754925174",
"115524262893538124163787151140784075413"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-49930-c3b5fd43",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@69f253e46af98af17e3efa3e5dfa72fcb7d1983d",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/ath11k/dp_rx.c",
"function": "ath11k_dp_process_rx"
},
"deprecated": false,
"signature_type": "Function",
"digest": {
"length": 2897.0,
"function_hash": "249205558426384909851536891838546079447"
}
},
{
"id": "CVE-2024-49930-d3482e3f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73e235728e515faccc104b0153b47d0f263b3344",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/ath11k/dp_rx.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"322444651299801484029435035027230363065",
"235315592489064000802182128623881804600",
"70754909493169619303423059166754925174",
"115524262893538124163787151140784075413"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-49930-da2142a4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01b77f5ee11c89754fb836af8f76799d3b72ae2f",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/ath11k/dp_rx.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"322444651299801484029435035027230363065",
"235315592489064000802182128623881804600",
"70754909493169619303423059166754925174",
"115524262893538124163787151140784075413"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-49930-f059aeb9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6045ef5b4b00fee3629689f791992900a1c94009",
"signature_version": "v1",
"target": {
"file": "drivers/net/wireless/ath/ath11k/dp_rx.c"
},
"deprecated": false,
"signature_type": "Line",
"digest": {
"line_hashes": [
"322444651299801484029435035027230363065",
"235315592489064000802182128623881804600",
"70754909493169619303423059166754925174",
"115524262893538124163787151140784075413"
],
"threshold": 0.9
}
}
]