Infinite Loop Vulnerability in Linux Kernel's iwlwifi Package During 6 GHz Scanning
Summary
CVE-2024-53055: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix 6 GHz scan construction If more than 255 colocated APs exist for the set of all APs found during 2.4/5 GHz scanning, then the 6... Affects linux versions < 6.1.119-1. Fixed in 6.1.119-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. The iwlwifi package is responsible for supporting Intel wireless devices, enabling connectivity and communication over Wi-Fi networks. This package is crucial for users relying on wireless networking capabilities, and any vulnerabilities can significantly impact system performance and security.
Vulnerability Detail
The vulnerability identified as CVE-2024-53055 arises from a flaw in the 6 GHz scan construction process within the iwlwifi module of the Linux kernel. When more than 255 colocated Access Points (APs) are detected during 2.4/5 GHz scanning, the scanning process enters an infinite loop due to the loop variable being of type u8, which cannot accommodate values greater than 255. This can lead to system instability and unresponsive behavior, as the scanning process fails to complete. The issue is exacerbated by the fact that the loop variable is stored in a u32 variable, which can hold larger values, but the loop's design limits its functionality.
How To Fix
Minimum fixed version
6.1.119-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk.
Conclusion
CVE-2024-53055 is a significant vulnerability in the Linux kernel's iwlwifi package that can lead to severe system issues due to an infinite loop during scanning processes. Users are strongly encouraged to update their systems to the latest patched version to ensure stability and security.
See every vulnerability recorded for linux →
FAQ
CVE-2024-53055 is a vulnerability in the Linux kernel's iwlwifi package that can cause an infinite loop during 6 GHz scanning when more than 255 colocated APs are detected.
This vulnerability can lead to system instability and unresponsiveness, as the scanning process fails to complete due to the infinite loop.
Yes, a patch is available for Debian 13 in version 6.11.7-1. Users should update their Linux kernel package to this version to fix the vulnerability.
While there are no specific workarounds, it is advisable to monitor your system for any unusual behavior and apply the patch as soon as possible.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to install anything.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
