In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: clear link ID from bitmap during link delete after clean up
Currently, during link deletion, the link ID is first removed from the validlinks bitmap before performing any clean-up operations. However, some functions require the link ID to remain in the validlinks bitmap. One such example is cfg80211cacevent(). The flow is -
nl80211removelink() cfg80211removelink() ieee80211delintflink() ieee80211vifsetlinks() ieee80211vifupdatelinks() ieee80211linkstop() cfg80211cac_event()
cfg80211cacevent() requires link ID to be present but it is cleared already in cfg80211removelink(). Ultimately, WARN_ON() is hit.
Therefore, clear the link ID from the bitmap only after completing the link clean-up.
[
{
"signature_type": "Function",
"id": "CVE-2024-57898-5352cc4a",
"target": {
"file": "net/mac80211/cfg.c",
"function": "ieee80211_del_intf_link"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae07daf440d3220d0986e676317a5da66e4f9dfd",
"signature_version": "v1",
"digest": {
"function_hash": "104443311150834061334865753564991464495",
"length": 205.0
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-57898-7606646e",
"target": {
"file": "net/mac80211/cfg.c",
"function": "ieee80211_del_intf_link"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5c32ff6a3a38c74facdd1fe34c0d709a55527fd",
"signature_version": "v1",
"digest": {
"function_hash": "104443311150834061334865753564991464495",
"length": 205.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-57898-850c7381",
"target": {
"file": "net/wireless/util.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5c32ff6a3a38c74facdd1fe34c0d709a55527fd",
"signature_version": "v1",
"digest": {
"line_hashes": [
"57943351114248898128070985233326341117",
"27752519650053244985650685801113012713",
"228894253905460738336521931388656737677",
"241569077891359343740841390934388103055",
"267002818907030669063717922133294804305"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-57898-8b802785",
"target": {
"file": "net/wireless/util.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae07daf440d3220d0986e676317a5da66e4f9dfd",
"signature_version": "v1",
"digest": {
"line_hashes": [
"57943351114248898128070985233326341117",
"27752519650053244985650685801113012713",
"228894253905460738336521931388656737677",
"241569077891359343740841390934388103055",
"267002818907030669063717922133294804305"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-57898-b183f312",
"target": {
"file": "net/wireless/util.c",
"function": "cfg80211_remove_link"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5c32ff6a3a38c74facdd1fe34c0d709a55527fd",
"signature_version": "v1",
"digest": {
"function_hash": "213008786215511249479630390021724931583",
"length": 423.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-57898-daadb52f",
"target": {
"file": "net/mac80211/cfg.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5c32ff6a3a38c74facdd1fe34c0d709a55527fd",
"signature_version": "v1",
"digest": {
"line_hashes": [
"165492869501807078432469783385079748234",
"310601361459007922219182352640106257437",
"24340453581140793142654588834044619382",
"21069118253078864355450704277217406227",
"137340443261314157872946067631387574759",
"33005833381999626383398596608042429291"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-57898-ed3af51b",
"target": {
"file": "net/wireless/util.c",
"function": "cfg80211_remove_link"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae07daf440d3220d0986e676317a5da66e4f9dfd",
"signature_version": "v1",
"digest": {
"function_hash": "213008786215511249479630390021724931583",
"length": 423.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-57898-f36fd057",
"target": {
"file": "net/mac80211/cfg.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae07daf440d3220d0986e676317a5da66e4f9dfd",
"signature_version": "v1",
"digest": {
"line_hashes": [
"165492869501807078432469783385079748234",
"310601361459007922219182352640106257437",
"24340453581140793142654588834044619382",
"21069118253078864355450704277217406227",
"137340443261314157872946067631387574759",
"33005833381999626383398596608042429291"
],
"threshold": 0.9
},
"deprecated": false
}
]