CVE-2024-56539

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()

Replace one-element array with a flexible-array member in `struct

mwifiex_ie_types_wildcard_ssid_params` to fix the following warning

on a MT8173 Chromebook (mt8173-elm-hana):

[ 356.775250] ------------[ cut here ]------------

[ 356.784543] memcpy: detected field-spanning write (size 6) of single field "wildcard_ssid_tlv->ssid" at drivers/net/wireless/marvell/mwifiex/scan.c:904 (size 1)

[ 356.813403] WARNING: CPU: 3 PID: 742 at drivers/net/wireless/marvell/mwifiex/scan.c:904 mwifiex_scan_networks+0x4fc/0xf28 [mwifiex]

The "(size 6)" above is exactly the length of the SSID of the network

this device was connected to. The source of the warning looks like:

ssid_len = user_scan_in->ssid_list[i].ssid_len;

[...]

memcpy(wildcard_ssid_tlv->ssid,

user_scan_in->ssid_list[i].ssid, ssid_len);

There is a #define WILDCAR

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References