Critical NULL Pointer Dereference Vulnerability in Linux Kernel (CVE-2024-49929)
Summary
CVE-2024-49929: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: avoid NULL pointer dereference iwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu() verify that the mvmvsta pointer is not NULL. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its robustness and versatility, supporting a wide range of devices and applications. However, vulnerabilities can arise, such as CVE-2024-49929, which affects the iwlwifi driver responsible for wireless networking. This vulnerability can lead to system instability and potential crashes if exploited.
Vulnerability Detail
CVE-2024-49929 is a NULL pointer dereference vulnerability found in the iwlwifi driver of the Linux kernel. The issue originates from the functions iwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu(), which fail to check if the mvmvsta pointer is NULL before dereferencing it. This oversight occurs when the ieee80211_sta pointer is NULL, leading to a potential system crash or instability. Exploiting this vulnerability could allow an attacker to disrupt network services or cause a denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as they are released.
Conclusion
CVE-2024-49929 is a critical vulnerability in the Linux kernel's iwlwifi driver that can lead to significant system issues if not addressed. Users are strongly advised to update their systems to the latest patched versions to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for linux →
FAQ
CVE-2024-49929 is a vulnerability in the Linux kernel's iwlwifi driver that can lead to a NULL pointer dereference, potentially causing system crashes.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
Exploiting this vulnerability can lead to system instability, crashes, and denial of service, affecting network services.
Yes, users should update their Linux kernel to the latest version that addresses CVE-2024-49929.
You can update your Linux kernel on Debian systems using the commands: sudo apt-get update and sudo apt-get install linux.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
