CVE-2024-38572

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-38572
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-38572.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-38572
Downstream
Related
Published
2024-06-19T13:35:37.666Z
Modified
2026-05-15T11:53:39.820906973Z
Summary
wifi: ath12k: fix out-of-bound access of qmi_invoke_handler()
Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix out-of-bound access of qmiinvokehandler()

Currently, there is no terminator entry for ath12kqmimsg_handlers hence facing below KASAN warning,

================================================================== BUG: KASAN: global-out-of-bounds in qmiinvokehandler+0xa4/0x148 Read of size 8 at addr ffffffd00a6428d8 by task kworker/u8:2/1273

CPU: 0 PID: 1273 Comm: kworker/u8:2 Not tainted 5.4.213 #0 Workqueue: qmimsghandler qmidatareadywork Call trace: dumpbacktrace+0x0/0x20c showstack+0x14/0x1c dumpstack+0xe0/0x138 printaddressdescription.isra.5+0x30/0x330 __kasanreport+0x16c/0x1bc kasanreport+0xc/0x14 _asanload8+0xa8/0xb0 qmiinvokehandler+0xa4/0x148 qmihandlemessage+0x18c/0x1bc qmidatareadywork+0x4ec/0x528 processonework+0x2c0/0x440 workerthread+0x324/0x4b8 kthread+0x210/0x228 retfromfork+0x10/0x18

The address belongs to the variable: ath12kmacmonstatusfilter_default+0x4bd8/0xfffffffffffe2300 [ath12k] [...] ==================================================================

Add a dummy terminator entry at the end to assist the qmiinvokehandler() in traversing up to the terminator entry without accessing an out-of-boundary index.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38572.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.3.0
Fixed
6.6.33
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.8.12
Type
ECOSYSTEM
Events
Introduced
6.9.0
Fixed
6.9.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-38572.json"