IM
IronMonkey Threat Research

CVE-2024-40941 HIGH

Published: 2024-07-12 | Last Modified: 2026-08-04 | Status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't read past the mfuart notifcation In case the firmware sends a notification that claims it has more data than it has, we will read past that was allocated for the notification. Remove the print of the buffer, we won't see it by default. If needed, we can see the content with tracing. This was reported by KFENCE.

Additional Descriptions (1)

En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: wifi: iwlwifi: mvm: no leer más allá de la notificación mfuart En caso de que el firmware envíe una notificación que dice que tiene más datos de los que tiene, leeremos más allá de los asignados para la notificación. Elimina la impresión del búfer, no la veremos por defecto. Si es necesario, podemos ver el contenido con rastreo. Así lo informó KFENCE.

CVSS Metrics

Base Score: 5.5 (MEDIUM)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.8

Impact Score: 3.6

Weaknesses

Source Type Description
[email protected] Primary
en NVD-CWE-noinfo

Affected Products

Vendor Product Version Update Type
linux linux_kernel * <built-in method update of dict object at 0x7fd289d3d280> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd370381d00> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd349260940> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd342602600> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd289d3c580> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd2dbd62ec0> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd36a2b1cc0> Operating System
linux linux_kernel 6.10 <built-in method update of dict object at 0x7fd349260a40> Operating System
linux linux_kernel 6.10 <built-in method update of dict object at 0x7fd36a2b3a40> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*

References