CVE-2024-56541

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix use-after-free in ath12k_dp_cc_cleanup()

During ath12k module removal, in ath12k_core_deinit(),

ath12k_mac_destroy() un-registers ah->hw from mac80211 and frees

the ah->hw as well as all the ar's in it. After this

ath12k_core_soc_destroy()-> ath12k_dp_free()-> ath12k_dp_cc_cleanup()

tries to access one of the freed ar's from pending skb.

This is because during mac destroy, driver failed to flush few

data packets, which were accessed later in ath12k_dp_cc_cleanup()

and freed, but using ar from the packet led to this use-after-free.

BUG: KASAN: use-after-free in ath12k_dp_cc_cleanup.part.0+0x5e2/0xd40 [ath12k]

Write of size 4 at addr ffff888150bd3514 by task modprobe/8926

CPU: 0 UID: 0 PID: 8926 Comm: modprobe Not tainted

6.11.0-rc2-wt-ath+ #1746

Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS

HNKBLi70.86A.0067.2021.0528.1339 05/28/2021

Call Trace:

<TASK>

dump_stack_lvl+0x7d/0x

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References