{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-44997", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-21T05:34:56.672Z", "datePublished": "2024-09-04T19:54:42.181Z", "dateUpdated": "2026-08-05T11:37:35.201Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:37:35.201Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()\n\nWhen there are multiple ap interfaces on one band and with WED on,\nturning the interface down will cause a kernel panic on MT798X.\n\nPreviously, cb_priv was freed in mtk_wed_setup_tc_block() without\nmarking NULL,and mtk_wed_setup_tc_block_cb() didn't check the value, too.\n\nAssign NULL after free cb_priv in mtk_wed_setup_tc_block() and check NULL\nin mtk_wed_setup_tc_block_cb().\n\n----------\nUnable to handle kernel paging request at virtual address 0072460bca32b4f5\nCall trace:\n mtk_wed_setup_tc_block_cb+0x4/0x38\n 0xffffffc0794084bc\n tcf_block_playback_offloads+0x70/0x1e8\n tcf_block_unbind+0x6c/0xc8\n...\n---------" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is entered only through local configuration operations (netlink tc qdisc/filter add-delete or bringing the AP interface down), not from received network frames. A remote or Wi-Fi-adjacent peer cannot cause a tc flow-block unbind.\nAC:L - The `kfree(cb_priv)` and the subsequent `tcf_block_playback_offloads()` call using that same pointer are on one uninterrupted code path, so the UAF fires deterministically whenever a filter exists in the block — the commit describes a reliable panic. No condition outside the attacker's control is involved.\nPR:L - Only `CAP_NET_ADMIN` over the netdev's network namespace is required — no capability check exists in the driver itself — and tc qdisc/filter bind-unbind is exactly the class of operation an unprivileged user obtains via `unshare -Urn` once a netdev is delegated to a namespace they own. No init-namespace root privilege is needed by the vulnerable code.\nUI:N - The attacker performs the qdisc/filter or interface-down operation themselves; no action by any other user or victim process is needed.\nS:U - The corruption stays within the kernel's own security authority on the affected host; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The freed kmalloc-16 object is re-read as two pointers and then dereferenced (`tc_can_offload(priv->dev)` reads `dev->features`, `hw->eth`/`hw->index` are consumed by `mtk_flow_offload_cmd()`), so heap grooming of the freed slot turns this into an attacker-directed kernel memory read.\nI:H - Use-after-free with controlled pointer contents flowing into `mtk_flow_offload_cmd()` → `mtk_flow_offload_destroy()`, which performs rhashtable manipulation and PPE-entry writes through the corrupted `eth` pointer, giving a write primitive usable for control-flow hijack.\nA:H - The reported symptom is an immediate kernel panic (\"Unable to handle kernel paging request\") on every affected interface teardown, a full denial of service on the router." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/mediatek/mtk_wed.c" ], "versions": [ { "version": "799684448e3e1f57257a6155541e53510488f67b", "lessThan": "326a89321f9d5fe399fe6f9ff7c0fc766582a6a0", "status": "affected", "versionType": "git" }, { "version": "799684448e3e1f57257a6155541e53510488f67b", "lessThan": "b453a4bbda03aa8741279c360ac82d1c3ac33548", "status": "affected", "versionType": "git" }, { "version": "799684448e3e1f57257a6155541e53510488f67b", "lessThan": "db1b4bedb9b97c6d34b03d03815147c04fffe8b4", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/mediatek/mtk_wed.c" ], "versions": [ { "version": "6.2", "status": "affected" }, { "version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.48", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.7", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.48" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.10.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/326a89321f9d5fe399fe6f9ff7c0fc766582a6a0" }, { "url": "https://git.kernel.org/stable/c/b453a4bbda03aa8741279c360ac82d1c3ac33548" }, { "url": "https://git.kernel.org/stable/c/db1b4bedb9b97c6d34b03d03815147c04fffe8b4" } ], "title": "net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-09-04T20:19:10.367821Z", "id": "CVE-2024-44997", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-04T20:19:22.792Z" } } ] } }