Kernel Vulnerability in Linux Package: Crash During Unbinding in ath12k Driver
Summary
DEBIAN-CVE-2024-53188: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix crash when unbinding If there is an error during some initialization related to firmware, the function ath12k_dp_cc_cleanup is called... Affects linux versions < 6.12.3-1. Fixed in 6.12.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and hardware communication. It supports a wide range of hardware and provides essential services for applications. The ath12k driver is a part of the Linux kernel that manages Qualcomm Atheros 12k wireless devices. This driver is crucial for enabling wireless connectivity and ensuring stable performance. However, it has been identified to have a vulnerability that can lead to system crashes under specific conditions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ath12k driver that can cause a kernel NULL pointer dereference, leading to a system crash. This issue arises during the unbinding process of the device when an error occurs during firmware initialization. The function ath12k_dp_cc_cleanup is called to release resources, but if this function is invoked after the resources have already been released, it results in a NULL pointer dereference. This vulnerability is reproducible in virtual machines due to failures in MSI addressing initialization, which can lead to significant system instability and crashes.
How To Fix
Minimum fixed version
6.12.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The identified vulnerability in the Linux kernel's ath12k driver poses a significant risk of system crashes due to NULL pointer dereference during device unbinding. Users are advised to update to the patched version 6.12.3-1 to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a kernel NULL pointer dereference in the ath12k driver, which can lead to system crashes.
If you are using a version of the Linux kernel prior to 6.12.3-1, your system may be affected by this vulnerability.
Exploitation of this vulnerability can lead to system crashes, instability, and loss of data.
Yes, a patch is available in version 6.12.3-1 of the Linux package.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using a manifest file like package-lock.json. You can check your application for vulnerabilities using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
