Critical Vulnerability in Linux Package: Incorrect TX Antenna Handling in mt76 Driver
Summary
DEBIAN-CVE-2024-47714: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: use hweight16 to get correct tx antenna The chainmask is u16 so using hweight8 cannot get correct tx_ant. Affects linux versions < 6.11.2-1. Fixed in 6.11.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It supports a wide range of devices and is crucial for system stability and performance. The mt76 driver is responsible for managing wireless network interfaces, and vulnerabilities in this driver can lead to significant issues in network connectivity and security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the mt76 driver, specifically in the mt7996 component. The issue arises from the use of hweight8 to calculate the transmission antenna (tx_ant), which is incorrect due to the chainmask being u16. This leads to the tx_ant of band 2 being set to -1, resulting in a stack-out-of-bounds error in the mt7996_mcu_add_sta function. This vulnerability can cause system crashes and instability, impacting network performance and reliability.
How To Fix
Minimum fixed version
6.11.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The identified vulnerability in the Linux kernel's mt76 driver poses a significant risk to system stability and network performance. It is crucial for users to update their systems to the patched version to mitigate these risks. Regular monitoring and prompt updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves incorrect handling of the transmission antenna in the mt76 driver, which can lead to system crashes.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
If exploited, this vulnerability can lead to network instability and crashes, affecting overall system performance.
Yes, a patch is available in version 6.11.2-1 of the Linux package for Debian 13 and 14.
While there are no specific workarounds, it is advisable to monitor your system closely and apply the patch as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
