Firmware Crash Vulnerability in Linux Kernel: ath12k Driver Issue
Summary
DEBIAN-CVE-2024-46827: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix firmware crash due to invalid peer nss Currently, if the access point receives an association request containing an Extended HE Capabi... Affects linux versions < 6.10.11-1. Fixed in 6.10.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. The 'linux' package in Debian versions 13 and 14 is critical for system stability and performance. This package supports various hardware components and includes drivers for wireless communication, such as the ath12k driver, which is responsible for managing Wi-Fi connections. The vulnerability in question affects the ath12k driver, leading to potential firmware crashes when handling invalid peer NSS values.
Vulnerability Detail
In the Linux kernel, a vulnerability exists in the ath12k driver that can cause a firmware crash when an access point receives an association request with an invalid MCS-NSS value. This issue arises when the Extended HE Capabilities Information Element indicates support for a bandwidth, but the MCS-NSS for that bandwidth is incorrectly set to zero. As a result, the driver interprets the peer_nss value as zero and forwards it to the firmware, triggering a crash. The lack of validation for the peer_nss value before sending it to the firmware is the root cause of this vulnerability, which can lead to significant disruptions in wireless connectivity.
How To Fix
Minimum fixed version
6.10.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can reject association requests that contain invalid MCS-NSS values. This can be done by implementing a validation step in the driver code to check the peer_nss value before forwarding it to the firmware. If the value is less than or equal to zero, the association request should be rejected.
Conclusion
The vulnerability in the ath12k driver of the Linux kernel poses a risk of firmware crashes due to improper handling of invalid MCS-NSS values. Users are advised to update their systems to the latest patched version to mitigate this risk. Implementing validation checks can serve as a temporary workaround until the update can be applied.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to firmware crashes, resulting in loss of wireless connectivity and potential disruptions in network services.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability affects the 'linux' package in Debian versions 13 and 14 prior to the patched version 6.10.11-1.
Yes, updating to the patched version 6.10.11-1 or later resolves the vulnerability.
If you cannot update immediately, implement the suggested workaround to validate peer_nss values before processing association requests.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
