Critical Vulnerability in Linux Kernel: Beacon Transmission Issue in ath11k Driver
Summary
DEBIAN-CVE-2024-47724: In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: use work queue to process beacon tx event Commit 3a415daa3e8b ("wifi: ath11k: add P2P IE in beacon template") from Feb 28, 2024 (linux-nex... Affects linux versions < 6.11.2-1. Fixed in 6.11.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for all other parts of the system. It manages hardware resources, system calls, and provides a foundation for user applications. The ath11k driver is responsible for managing wireless communication for certain Qualcomm chipsets. This driver is crucial for enabling Wi-Fi functionality, and any vulnerabilities within it can lead to significant security risks, including unauthorized access or denial of service.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ath11k driver related to the processing of beacon transmission events. The issue arises from the use of a function that can sleep during atomic context, which can lead to deadlocks or crashes. This vulnerability was introduced by a commit that added support for P2P IE in beacon templates, and it was further complicated by subsequent changes that attempted to fix related warnings. The vulnerability can potentially allow an attacker to exploit the driver during critical sections, leading to instability in wireless communication.
How To Fix
Minimum fixed version
6.11.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to avoid using the ath11k driver until the patch is applied to mitigate potential risks.
Conclusion
The vulnerability in the Linux kernel's ath11k driver poses significant risks to system stability and wireless communication. Users are strongly encouraged to update to the patched version to ensure their systems remain secure. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system instability and potential crashes during wireless communication, which may affect connectivity and performance.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, the patched version of the Linux kernel is 6.11.2-1. Users should update their systems to this version to mitigate the vulnerability.
If you cannot update your kernel immediately, it is advisable to limit the use of wireless functionalities that rely on the ath11k driver until the patch is applied.
More information can be found in the official Debian CVE database or by reviewing the commit history related to the ath11k driver.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
