{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-47724", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-30T16:00:12.956Z", "datePublished": "2024-10-21T12:13:58.267Z", "dateUpdated": "2026-08-05T11:39:44.134Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:39:44.134Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: use work queue to process beacon tx event\n\nCommit 3a415daa3e8b (\"wifi: ath11k: add P2P IE in beacon template\")\nfrom Feb 28, 2024 (linux-next), leads to the following Smatch static\nchecker warning:\n\ndrivers/net/wireless/ath/ath11k/wmi.c:1742 ath11k_wmi_p2p_go_bcn_ie()\nwarn: sleeping in atomic context\n\nThe reason is that ath11k_bcn_tx_status_event() will directly call might\nsleep function ath11k_wmi_cmd_send() during RCU read-side critical\nsections. The call trace is like:\n\nath11k_bcn_tx_status_event()\n-> rcu_read_lock()\n-> ath11k_mac_bcn_tx_event()\n\t-> ath11k_mac_setup_bcn_tmpl()\n\t……\n\t\t-> ath11k_wmi_bcn_tmpl()\n\t\t\t-> ath11k_wmi_cmd_send()\n-> rcu_read_unlock()\n\nCommit 886433a98425 (\"ath11k: add support for BSS color change\") added the\nath11k_mac_bcn_tx_event(), commit 01e782c89108 (\"ath11k: fix warning\nof RCU usage for ath11k_mac_get_arvif_by_vdev_id()\") added the RCU lock\nto avoid warning but also introduced this BUG.\n\nUse work queue to avoid directly calling ath11k_mac_bcn_tx_event()\nduring RCU critical sections. No need to worry about the deletion of vif\nbecause cancel_work_sync() will drop the work if it doesn't start or\nblock vif deletion until the running work is done.\n\nTested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The trigger is the ath11k AP's BSS color-change state, which an attacker forces by transmitting beacons carrying the AP's BSS color in the HE Operation IE, causing firmware OBSS color-collision detection and an automatic hostapd color change. This requires only being within WiFi radio range of the target AP, not a routable network path.\nAC:L - Once a color change is active, every beacon TX status event (roughly every 100 ms) deterministically enters ath11k_mac_bcn_tx_event() and calls the might_sleep() WMI send from tasklet/RCU context, and the attacker controls the collision beacon that starts the color change. No unpredictable memory layout or victim state is needed.\nPR:N - Injecting a beacon frame with a colliding BSS color requires no association, authentication, or credentials on the target AP, and no account on the host. The color change that arms the bug is initiated automatically by hostapd in response to the attacker's frame.\nUI:N - No action by any user or administrator is needed; the OBSS color-collision notification and the resulting color change are handled automatically by the firmware, mac80211, and hostapd.\nS:U - The corruption and crash are confined to the kernel of the AP device itself, with no crossing into a different security authority such as a hypervisor or IOMMU boundary.\nC:H - Sleeping inside the RCU read-side critical section makes the voluntary schedule a quiescent state, so synchronize_rcu() in the pdev/vdev teardown path can complete while ath11k_mac_setup_bcn_tmpl() still dereferences the freed ath11k_vif/ath11k structures, yielding a use-after-free read of kernel heap contents.\nI:H - The same use-after-free window lets the driver write into freed memory (arvif->rsnie_present, wpaie_present, bcca_zero_sent, and WMI command buffers built from freed ar/wmi pointers), and the missing conf_mutex means these writes race with vdev deletion; additionally wait_event_timeout() in tasklet context corrupts an unrelated task's state and leaves a wait-queue entry on the interrupt stack.\nA:H - Calling a might_sleep() function from the CE tasklet produces \"BUG: sleeping function called from invalid context\" and, when WMI credits are unavailable, \"BUG: scheduling while atomic\" with a potential panic; the tasklet never reaches its enable_irq(), permanently disabling the Copy Engine interrupt and wedging the wireless device." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/ath/ath11k/core.h", "drivers/net/wireless/ath/ath11k/mac.c", "drivers/net/wireless/ath/ath11k/wmi.c" ], "versions": [ { "version": "3a415daa3e8ba65f1cc976c172a5ab69bdc17e69", "lessThan": "dbd51da69dda1137723b8f66460bf99a9dac8dd2", "status": "affected", "versionType": "git" }, { "version": "3a415daa3e8ba65f1cc976c172a5ab69bdc17e69", "lessThan": "6db232905e094e64abff1f18249905d068285e09", "status": "affected", "versionType": "git" }, { "version": "3a415daa3e8ba65f1cc976c172a5ab69bdc17e69", "lessThan": "177b49dbf9c1d8f9f25a22ffafa416fc2c8aa6a3", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/ath/ath11k/core.h", "drivers/net/wireless/ath/ath11k/mac.c", "drivers/net/wireless/ath/ath11k/wmi.c" ], "versions": [ { "version": "6.10", "status": "affected" }, { "version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.13", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.2", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.10.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.11.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/dbd51da69dda1137723b8f66460bf99a9dac8dd2" }, { "url": "https://git.kernel.org/stable/c/6db232905e094e64abff1f18249905d068285e09" }, { "url": "https://git.kernel.org/stable/c/177b49dbf9c1d8f9f25a22ffafa416fc2c8aa6a3" } ], "title": "wifi: ath11k: use work queue to process beacon tx event", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-47724", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-10-21T13:01:30.955907Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T13:04:16.907Z" } } ] } }