Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() mwifiex_get_priv_by_id() returns the priv pointer corresponding to the bss_num and bss_type, but without checking if the priv is actually currently in use. Unused priv pointers do not have a wiphy attached to them which can lead to NULL pointer dereferences further down the callstack. Fix this by returning only used priv pointers which have priv->bss_mode set to something else than NL80211_IFTYPE_UNSPECIFIED. Said NULL pointer dereference happened when an Accesspoint was started with wpa_supplicant -i mlan0 with this config: network={ ssid="somessid" mode=2 frequency=2412 key_mgmt=WPA-PSK WPA-PSK-SHA256 proto=RSN group=CCMP pairwise=CCMP psk="12345678" } When waiting for the AP to be established, interrupting wpa_supplicant with <ctrl-c> and starting it again this happens: | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000140 | Mem abort info: | ESR = 0x0000000096000004 | EC = 0x25: DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: level 0 translation fault | Data abort info: | ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 | CM = 0, WnR = 0, TnD = 0, TagAccess = 0 | GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000046d96000 | [0000000000000140] pgd=0000000000000000, p4d=0000000000000000 | Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP | Modules linked in: caam_jr caamhash_desc spidev caamalg_desc crypto_engine authenc libdes mwifiex_sdio +mwifiex crct10dif_ce cdc_acm onboard_usb_hub fsl_imx8_ddr_perf imx8m_ddrc rtc_ds1307 lm75 rtc_snvs +imx_sdma caam imx8mm_thermal spi_imx error imx_cpufreq_dt fuse ip_tables x_tables ipv6 | CPU: 0 PID: 8 Comm: kworker/0:1 Not tainted 6.9.0-00007-g937242013fce-dirty #18 | Hardware name: somemachine (DT) | Workqueue: events sdio_irq_work | pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : mwifiex_get_cfp+0xd8/0x15c [mwifiex] | lr : mwifiex_get_cfp+0x34/0x15c [mwifiex] | sp : ffff8000818b3a70 | x29: ffff8000818b3a70 x28: ffff000006bfd8a5 x27: 0000000000000004 | x26: 000000000000002c x25: 0000000000001511 x24: 0000000002e86bc9 | x23: ffff000006bfd996 x22: 0000000000000004 x21: ffff000007bec000 | x20: 000000000000002c x19: 0000000000000000 x18: 0000000000000000 | x17: 000000040044ffff x16: 00500072b5503510 x15: ccc283740681e517 | x14: 0201000101006d15 x13: 0000000002e8ff43 x12: 002c01000000ffb1 | x11: 0100000000000000 x10: 02e8ff43002c0100 x9 : 0000ffb100100157 | x8 : ffff000003d20000 x7 : 00000000000002f1 x6 : 00000000ffffe124 | x5 : 0000000000000001 x4 : 0000000000000003 x3 : 0000000000000000 | x2 : 0000000000000000 x1 : 0001000000011001 x0 : 0000000000000000 | Call trace: | mwifiex_get_cfp+0xd8/0x15c [mwifiex] | mwifiex_parse_single_response_buf+0x1d0/0x504 [mwifiex] | mwifiex_handle_event_ext_scan_report+0x19c/0x2f8 [mwifiex] | mwifiex_process_sta_event+0x298/0xf0c [mwifiex] | mwifiex_process_event+0x110/0x238 [mwifiex] | mwifiex_main_process+0x428/0xa44 [mwifiex] | mwifiex_sdio_interrupt+0x64/0x12c [mwifiex_sdio] | process_sdio_pending_irqs+0x64/0x1b8 | sdio_irq_work+0x4c/0x7c | process_one_work+0x148/0x2a0 | worker_thread+0x2fc/0x40c | kthread+0x110/0x114 | ret_from_fork+0x10/0x20 | Code: a94153f3 a8c37bfd d50323bf d65f03c0 (f940a000) | ---[ end trace 0000000000000000 ]---

Metrics

 

CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score:  5.5 MEDIUM

Vector:  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS 2.0 Severity and Vector Strings:

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
https://git.kernel.org/stable/c/1a05d8d02cfa3540ea5dbd6b39446bd3f515521f	Patch
https://git.kernel.org/stable/c/9813770f25855b866b8ead8155b8806b2db70f6d	Patch
https://git.kernel.org/stable/c/a12cf97cbefa139ef8d95081f2ea047cbbd74b7a	Patch
https://git.kernel.org/stable/c/c145eea2f75ff7949392aebecf7ef0a81c1f6c14	Patch
https://git.kernel.org/stable/c/c16916dd6c16fa7e13ca3923eb6b9f50d848ad03	Patch
https://git.kernel.org/stable/c/c2618dcb26c7211342b54520b5b148c0d3471c8a	Patch
https://git.kernel.org/stable/c/cb67b2e51b75f1a17bee7599c8161b96e1808a70	Patch
https://git.kernel.org/stable/c/d834433ff313838a259bb6607055ece87b895b66	Patch

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-476	NULL Pointer Dereference	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

2 change records found show changes

Initial Analysis by NIST 9/26/2024 9:25:54 AM

Action	Type	Old Value	New Value
Added	CVSS V3.1		NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Added	CWE		NIST CWE-476
Added	CPE Configuration		Record truncated, showing 500 of 735 characters. View Entire Change Record OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 4.19.322 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.284 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.226 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.167 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up
Changed	Reference Type	https://git.kernel.org/stable/c/1a05d8d02cfa3540ea5dbd6b39446bd3f515521f No Types Assigned	https://git.kernel.org/stable/c/1a05d8d02cfa3540ea5dbd6b39446bd3f515521f Patch
Changed	Reference Type	https://git.kernel.org/stable/c/9813770f25855b866b8ead8155b8806b2db70f6d No Types Assigned	https://git.kernel.org/stable/c/9813770f25855b866b8ead8155b8806b2db70f6d Patch
Changed	Reference Type	https://git.kernel.org/stable/c/a12cf97cbefa139ef8d95081f2ea047cbbd74b7a No Types Assigned	https://git.kernel.org/stable/c/a12cf97cbefa139ef8d95081f2ea047cbbd74b7a Patch
Changed	Reference Type	https://git.kernel.org/stable/c/c145eea2f75ff7949392aebecf7ef0a81c1f6c14 No Types Assigned	https://git.kernel.org/stable/c/c145eea2f75ff7949392aebecf7ef0a81c1f6c14 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/c16916dd6c16fa7e13ca3923eb6b9f50d848ad03 No Types Assigned	https://git.kernel.org/stable/c/c16916dd6c16fa7e13ca3923eb6b9f50d848ad03 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/c2618dcb26c7211342b54520b5b148c0d3471c8a No Types Assigned	https://git.kernel.org/stable/c/c2618dcb26c7211342b54520b5b148c0d3471c8a Patch
Changed	Reference Type	https://git.kernel.org/stable/c/cb67b2e51b75f1a17bee7599c8161b96e1808a70 No Types Assigned	https://git.kernel.org/stable/c/cb67b2e51b75f1a17bee7599c8161b96e1808a70 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/d834433ff313838a259bb6607055ece87b895b66 No Types Assigned	https://git.kernel.org/stable/c/d834433ff313838a259bb6607055ece87b895b66 Patch

New CVE Received from kernel.org 9/18/2024 4:15:04 AM

Action	Type	Old Value	New Value
Added	Description		Record truncated, showing 500 of 3542 characters. View Entire Change Record In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() mwifiex_get_priv_by_id() returns the priv pointer corresponding to the bss_num and bss_type, but without checking if the priv is actually currently in use. Unused priv pointers do not have a wiphy attached to them which can lead to NULL pointer dereferences further down the callstack. Fix this by returning only used priv pointers which have priv->bss_mode se
Added	Reference		kernel.org https://git.kernel.org/stable/c/1a05d8d02cfa3540ea5dbd6b39446bd3f515521f [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/9813770f25855b866b8ead8155b8806b2db70f6d [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/a12cf97cbefa139ef8d95081f2ea047cbbd74b7a [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/c145eea2f75ff7949392aebecf7ef0a81c1f6c14 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/c16916dd6c16fa7e13ca3923eb6b9f50d848ad03 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/c2618dcb26c7211342b54520b5b148c0d3471c8a [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/cb67b2e51b75f1a17bee7599c8161b96e1808a70 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/d834433ff313838a259bb6607055ece87b895b66 [No types assigned]