CVE-2024-45569: Critical Vulnerability in qca-wifi-host-cmn Package
Summary
CVE-2024-45569: ... Affects platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn versions >= SoCVersion:0, < SoCVersion:2025-02-05. Fixed in SoCVersion:2025-02-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The qca-wifi-host-cmn package is an essential component of the Android ecosystem, specifically designed for Qualcomm's wireless communication functionalities. It facilitates Wi-Fi connectivity and management in devices utilizing Qualcomm chipsets. This package is crucial for ensuring stable and efficient wireless communication, making it a key element in the overall performance of Android devices. However, it is susceptible to vulnerabilities that can compromise device security and functionality.
Vulnerability Detail
CVE-2024-45569 is a critical vulnerability found in the qca-wifi-host-cmn package. This issue originates from improper handling of link information parsing within the utility functions of the package. If exploited, this vulnerability could allow an attacker to manipulate Wi-Fi link information, potentially leading to unauthorized access or denial of service. The technical aspects of this vulnerability involve the function 'util_parse_pa_info_from_linkinfo' located in the 'utils_mlo.c' file, which fails to validate input correctly, making it a target for exploitation.
How To Fix
Minimum fixed version
SoCVersion:2025-02-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is highly recommended to apply the patch as soon as it becomes available to mitigate any potential risks.
Conclusion
In summary, CVE-2024-45569 represents a critical vulnerability in the qca-wifi-host-cmn package that poses significant risks to device security. Users are strongly encouraged to update to the patched version to safeguard their systems against potential exploitation.
See every vulnerability recorded for platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn →
FAQ
CVE-2024-45569 is a critical vulnerability in the qca-wifi-host-cmn package that can lead to unauthorized access or denial of service due to improper input handling.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability could allow attackers to manipulate Wi-Fi link information, leading to unauthorized access or disruption of service.
You can update the package by running the command: 'git pull https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn.git && git checkout 8f2ac621950419d1cd69ca125a6f3dfc24ff8860'.
Currently, there are no specific workarounds available. The best course of action is to apply the patch as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn.
