CVE-2024-53055

5.5 · MEDIUM

Published Nov 19, 2024 linux CWE-835 EPSS 0.26% (17th pctl) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Overview

CVE-2024-53055 is a medium-severity vulnerability affecting linux linux_kernel. It was published on November 19, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix 6 GHz scan construction

If more than 255 colocated APs exist for the set of all

APs found during 2.4/5 GHz scanning, then the 6 GHz scan

construction will loop forever since the loop variable

has type u8, which can never reach the number found when

that's bigger than 255, and is stored in a u32 variable.

Also move it into the loops to have a smaller scope.

Using a u32 there is fine, we limit the number of APs in

the scan list and each has a limit on the number of RNR

entries due to the frame size. With a limit of 1000 scan

results, a frame size upper bound of 4096 (really it's

more like ~2300) and a TBTT entry size of at least 11,

we get an upper bound for the number of ~372k, well in

the bounds of a u32.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
linux	linux_kernel	>= 5.11, < 5.15.171	Affected

References

Ref git.kernel.org/stable/c/2ac15e5a8f42fed5d90ed9e1197600913678c50f Ref git.kernel.org/stable/c/2ccd5badadab2d586e91546bf5af3deda07fef1f Ref git.kernel.org/stable/c/7245012f0f496162dd95d888ed2ceb5a35170f1a Ref git.kernel.org/stable/c/cde8a7eb5c6762264ff0f4433358e0a0d250c875 Ref git.kernel.org/stable/c/fc621e7a043de346c33bd7ae7e2e0c651d6152ef Ref lists.debian.org/debian-lts-announce/2025/01/msg00001.html

Frequently Asked Questions

What is CVE-2024-53055?

CVE-2024-53055 is a medium-severity vulnerability affecting linux linux_kernel. It was published on November 19, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-53055?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-53055?

How can CyberStrike help with CVE-2024-53055?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-53055 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719