{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-43848", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-17T09:11:59.276Z", "datePublished": "2024-08-17T09:22:02.044Z", "dateUpdated": "2026-08-05T11:36:46.994Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:36:46.994Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix TTLM teardown work\n\nThe worker calculates the wrong sdata pointer, so if it ever\nruns, it'll crash. Fix that." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The vulnerable work is armed by 802.11 TX-status processing for an MLO/TTLM teardown frame, and its preconditions (MLD association plus an active negotiated TID-to-link mapping installed via PROTECTED_EHT action frames) are established entirely over the air by the peer AP. This requires radio-range/same-WiFi-segment access, matching the Adjacent vector used for mac80211 frame-driven bugs.\nAC:L - A rogue or evil-twin MLD AP fully controls the setup — it negotiates the TTLM that restricts links and ACKs the resulting teardown frame that queues the work — and once queued the fault is deterministic, since the bad pointer is a fixed -32-byte offset with no dependence on memory layout or timing.\nPR:N - The attacker operates as an 802.11be AP in radio range and needs no account, credentials, or any privilege on the victim system. No local access to the target is involved at any point in the path.\nUI:N - Association to a known/evil-twin SSID happens automatically via the supplicant's auto-join, and the teardown is initiated by the driver's own link-activation logic rather than by any user action. No victim interaction is needed to reach the faulty worker.\nS:U - The type confusion, the corrupting write, and the wild dereference all occur within the kernel's own memory and security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The wrong `container_of` yields a systematic type confusion in which `vif`, `local`, `flags`, `dev` and `link[]` are all read 32 bytes off, and the resulting bogus `local` (sourced from a timer `expires` field in the sub-4 GB, user-mappable range on non-SMAP systems) is dereferenced and used to reach `local->ops`, providing a read primitive over attacker-influenceable memory.\nI:H - The worker performs a 34-byte zeroing write 32 bytes before the intended target, clobbering live `vif.link_conf[12..14]`, `valid_links`, `active_links`, `dormant_links` and `suspended_links` on an active MLD connection, and then reaches an indirect call `local->ops->vif_cfg_changed()` through the confused pointer — memory corruption leverageable for control-flow hijacking.\nA:H - As the fix commit states outright, \"if it ever runs, it'll crash\": the bogus `local` pointer (NULL or a jiffies-derived address) is dereferenced in `drv_vif_cfg_changed()`, producing a kernel oops in the wiphy work handler, on top of MLD state corruption that causes further NULL dereferences." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/mac80211/mlme.c" ], "versions": [ { "version": "a17a58ad2ff24f0d201fa5f9939182f3757d1737", "lessThan": "9750899410c8478ef043c42029f4f6144c096eac", "status": "affected", "versionType": "git" }, { "version": "a17a58ad2ff24f0d201fa5f9939182f3757d1737", "lessThan": "2fe0a605d083b884490ee4de02be071b5b4291b1", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/mac80211/mlme.c" ], "versions": [ { "version": "6.10", "status": "affected" }, { "version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.3", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.10.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/9750899410c8478ef043c42029f4f6144c096eac" }, { "url": "https://git.kernel.org/stable/c/2fe0a605d083b884490ee4de02be071b5b4291b1" } ], "title": "wifi: mac80211: fix TTLM teardown work", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-43848", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:07:33.635400Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:21.571Z" } } ] } }