Critical Memory Access Vulnerability in Linux Package: CVE-2024-47715
Summary
DEBIAN-CVE-2024-47715: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix oops on non-dbdc mt7986 mt7915_band_config() sets band_idx = 1 on the main phy for mt7986 with MT7975_ONE_ADIE or MT7976_ONE_ADI... Affects linux versions < 6.11.2-1. Fixed in 6.11.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It serves as the foundation for various applications and services, ensuring efficient operation and communication between software and hardware. The vulnerability identified as CVE-2024-47715 affects specific hardware configurations, particularly involving the mt7986 chipset, leading to potential system crashes and instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the mt76 driver affecting devices with the mt7986 chipset. The issue arises from a race condition introduced by a commit that improperly handles the indexing of the phys array, leading to a dereference of an invalid memory address. This can result in a kernel panic, causing the system to become unresponsive. The vulnerability is triggered when the mt7915_band_config function incorrectly sets the band_idx, leading to an attempt to read from an unreadable memory location. The technical details indicate that this can lead to severe system instability and potential data loss.
How To Fix
Minimum fixed version
6.11.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected hardware configurations or disable the specific functionalities that rely on the mt76 driver until the package is updated. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The CVE-2024-47715 vulnerability in the Linux kernel poses significant risks to system stability for affected hardware configurations. Users are urged to update their Linux packages to the latest patched version to mitigate these risks effectively. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2024-47715 is a vulnerability in the Linux kernel affecting specific hardware configurations, leading to potential system crashes due to improper memory access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The risks include system instability, crashes, and potential data loss, especially for devices using the mt7986 chipset.
You can update the Linux package by running 'sudo apt-get update && sudo apt-get install linux' in your terminal.
Yes, the permanent fix is to update the Linux package to version 6.11.2-1 or later, which addresses the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
