CVE-2024-46755

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()

mwifiex_get_priv_by_id() returns the priv pointer corresponding to

the bss_num and bss_type, but without checking if the priv is actually

currently in use.

Unused priv pointers do not have a wiphy attached to them which can

lead to NULL pointer dereferences further down the callstack. Fix

this by returning only used priv pointers which have priv->bss_mode

set to something else than NL80211_IFTYPE_UNSPECIFIED.

Said NULL pointer dereference happened when an Accesspoint was started

with wpa_supplicant -i mlan0 with this config:

network={

ssid="somessid"

mode=2

frequency=2412

key_mgmt=WPA-PSK WPA-PSK-SHA256

proto=RSN

group=CCMP

pairwise=CCMP

psk="12345678"

}

When waiting for the AP to be established, interrupting wpa_supplicant

with <ctrl-c> and starting it again this happens:

| Unable

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References