In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: clear link ID from bitmap during link delete after clean up
Currently, during link deletion, the link ID is first removed from the validlinks bitmap before performing any clean-up operations. However, some functions require the link ID to remain in the validlinks bitmap. One such example is cfg80211cacevent(). The flow is -
nl80211removelink() cfg80211removelink() ieee80211delintflink() ieee80211vifsetlinks() ieee80211vifupdatelinks() ieee80211linkstop() cfg80211cac_event()
cfg80211cacevent() requires link ID to be present but it is cleared already in cfg80211removelink(). Ultimately, WARN_ON() is hit.
Therefore, clear the link ID from the bitmap only after completing the link clean-up.
[ { "signature_type": "Function", "id": "CVE-2024-57898-5352cc4a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae07daf440d3220d0986e676317a5da66e4f9dfd", "signature_version": "v1", "target": { "function": "ieee80211_del_intf_link", "file": "net/mac80211/cfg.c" }, "digest": { "function_hash": "104443311150834061334865753564991464495", "length": 205.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-57898-7606646e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5c32ff6a3a38c74facdd1fe34c0d709a55527fd", "signature_version": "v1", "target": { "function": "ieee80211_del_intf_link", "file": "net/mac80211/cfg.c" }, "digest": { "function_hash": "104443311150834061334865753564991464495", "length": 205.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-57898-850c7381", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5c32ff6a3a38c74facdd1fe34c0d709a55527fd", "signature_version": "v1", "target": { "file": "net/wireless/util.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "57943351114248898128070985233326341117", "27752519650053244985650685801113012713", "228894253905460738336521931388656737677", "241569077891359343740841390934388103055", "267002818907030669063717922133294804305" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-57898-8b802785", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae07daf440d3220d0986e676317a5da66e4f9dfd", "signature_version": "v1", "target": { "file": "net/wireless/util.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "57943351114248898128070985233326341117", "27752519650053244985650685801113012713", "228894253905460738336521931388656737677", "241569077891359343740841390934388103055", "267002818907030669063717922133294804305" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-57898-b183f312", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5c32ff6a3a38c74facdd1fe34c0d709a55527fd", "signature_version": "v1", "target": { "function": "cfg80211_remove_link", "file": "net/wireless/util.c" }, "digest": { "function_hash": "213008786215511249479630390021724931583", "length": 423.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-57898-daadb52f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5c32ff6a3a38c74facdd1fe34c0d709a55527fd", "signature_version": "v1", "target": { "file": "net/mac80211/cfg.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "165492869501807078432469783385079748234", "310601361459007922219182352640106257437", "24340453581140793142654588834044619382", "21069118253078864355450704277217406227", "137340443261314157872946067631387574759", "33005833381999626383398596608042429291" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-57898-ed3af51b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae07daf440d3220d0986e676317a5da66e4f9dfd", "signature_version": "v1", "target": { "function": "cfg80211_remove_link", "file": "net/wireless/util.c" }, "digest": { "function_hash": "213008786215511249479630390021724931583", "length": 423.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-57898-f36fd057", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae07daf440d3220d0986e676317a5da66e4f9dfd", "signature_version": "v1", "target": { "file": "net/mac80211/cfg.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "165492869501807078432469783385079748234", "310601361459007922219182352640106257437", "24340453581140793142654588834044619382", "21069118253078864355450704277217406227", "137340443261314157872946067631387574759", "33005833381999626383398596608042429291" ] }, "deprecated": false } ]