Link Mapping Resource Leak in Linux Kernel's iwlwifi Package
Summary
DEBIAN-CVE-2024-53074: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't leak a link on AP removal Release the link mapping resource in AP removal. Affects linux versions < 6.11.7-1. Fixed in 6.11.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware and system resources. The iwlwifi package is a driver for Intel wireless devices, enabling connectivity and communication over wireless networks. This package is crucial for devices relying on Intel's wireless chipsets, particularly those that do not support the MLD API, such as the 9260 and earlier models. The vulnerability in question affects the ability to restart an access point (AP) after it has been stopped, leading to potential connectivity issues.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the iwlwifi driver related to the management of link mapping resources during the removal of an access point (AP). Specifically, when an AP is removed, the link mapping resource is not properly released, which prevents the AP from being restarted. This issue primarily affects devices that do not support the MLD API, resulting in a failure to re-establish the AP connection after it has been stopped. The ramifications of this vulnerability include disrupted wireless connectivity and potential service interruptions for users relying on affected devices.
How To Fix
Minimum fixed version
6.11.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to apply the patch as soon as it is available to mitigate the issue.
Conclusion
The vulnerability identified in the Linux kernel's iwlwifi package poses a significant risk to devices that do not support the MLD API, affecting their ability to restart access points. Users are encouraged to update their systems to the patched version 6.11.7-1 to ensure continued connectivity and security.
See every vulnerability recorded for linux →
FAQ
The vulnerability prevents affected devices from restarting an access point after it has been stopped, leading to potential connectivity issues.
Devices that do not support the MLD API, specifically the Intel 9260 and earlier models, are impacted by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Yes, a patch is available in the form of the updated Linux package version 6.11.7-1.
While there are no specific workarounds, it is recommended to monitor your system for updates and apply the patch as soon as possible to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
