RCU Stall Vulnerability in Linux Kernel's ath11k Package: Infinite Loop Risk
Summary
CVE-2024-58097: In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix RCU stall while reaping monitor destination ring While processing the monitor destination ring, MSDUs are reaped from the link descrip... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. The ath11k driver is responsible for managing Qualcomm's Wi-Fi 6 chipsets, enabling wireless connectivity. This driver is crucial for maintaining stable and efficient network connections. However, it has been identified that a specific flaw in the ath11k driver can lead to a serious issue, causing system instability and crashes.
Vulnerability Detail
The vulnerability, identified as CVE-2024-58097, arises during the processing of the monitor destination ring in the ath11k driver. When the driver attempts to reap MSDUs (MAC Service Data Units) from the link descriptor using a buf_id provided by the hardware, it may encounter an invalid buf_id. This situation triggers an infinite loop in the destination processing, ultimately leading to a kernel crash. The kernel log indicates repeated failures in processing due to the invalid buf_id, which can severely impact system performance and reliability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can skip the problematic buf_id during the processing of MSDUs. This involves modifying the driver code to replace the break statement with a command to continue processing the next MSDU entry, thereby avoiding the infinite loop. However, this workaround requires technical expertise and should be approached with caution.
Conclusion
CVE-2024-58097 represents a significant vulnerability within the Linux kernel's ath11k driver, posing risks of system crashes and instability. It is crucial for users to update their systems to the patched version of the kernel to mitigate these risks. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2024-58097 is a vulnerability in the Linux kernel's ath11k driver that can cause an infinite loop and kernel crash due to invalid buffer IDs.
This vulnerability can lead to system instability, causing crashes and potentially impacting network connectivity.
The vulnerability affects systems running the Linux kernel with the ath11k driver, particularly on Debian versions 11, 12, and 13.
Yes, a patch has been released for the Linux kernel that addresses this vulnerability. Users should update their kernel to the latest version.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
