193 lines
10 KiB
JSON
193 lines
10 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2024-44997",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2024-08-21T05:34:56.672Z",
|
|
"datePublished": "2024-09-04T19:54:42.181Z",
|
|
"dateUpdated": "2026-08-05T11:37:35.201Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T11:37:35.201Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()\n\nWhen there are multiple ap interfaces on one band and with WED on,\nturning the interface down will cause a kernel panic on MT798X.\n\nPreviously, cb_priv was freed in mtk_wed_setup_tc_block() without\nmarking NULL,and mtk_wed_setup_tc_block_cb() didn't check the value, too.\n\nAssign NULL after free cb_priv in mtk_wed_setup_tc_block() and check NULL\nin mtk_wed_setup_tc_block_cb().\n\n----------\nUnable to handle kernel paging request at virtual address 0072460bca32b4f5\nCall trace:\n mtk_wed_setup_tc_block_cb+0x4/0x38\n 0xffffffc0794084bc\n tcf_block_playback_offloads+0x70/0x1e8\n tcf_block_unbind+0x6c/0xc8\n...\n---------"
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerable path is entered only through local configuration operations (netlink tc qdisc/filter add-delete or bringing the AP interface down), not from received network frames. A remote or Wi-Fi-adjacent peer cannot cause a tc flow-block unbind.\nAC:L - The `kfree(cb_priv)` and the subsequent `tcf_block_playback_offloads()` call using that same pointer are on one uninterrupted code path, so the UAF fires deterministically whenever a filter exists in the block — the commit describes a reliable panic. No condition outside the attacker's control is involved.\nPR:L - Only `CAP_NET_ADMIN` over the netdev's network namespace is required — no capability check exists in the driver itself — and tc qdisc/filter bind-unbind is exactly the class of operation an unprivileged user obtains via `unshare -Urn` once a netdev is delegated to a namespace they own. No init-namespace root privilege is needed by the vulnerable code.\nUI:N - The attacker performs the qdisc/filter or interface-down operation themselves; no action by any other user or victim process is needed.\nS:U - The corruption stays within the kernel's own security authority on the affected host; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The freed kmalloc-16 object is re-read as two pointers and then dereferenced (`tc_can_offload(priv->dev)` reads `dev->features`, `hw->eth`/`hw->index` are consumed by `mtk_flow_offload_cmd()`), so heap grooming of the freed slot turns this into an attacker-directed kernel memory read.\nI:H - Use-after-free with controlled pointer contents flowing into `mtk_flow_offload_cmd()` → `mtk_flow_offload_destroy()`, which performs rhashtable manipulation and PPE-entry writes through the corrupted `eth` pointer, giving a write primitive usable for control-flow hijack.\nA:H - The reported symptom is an immediate kernel panic (\"Unable to handle kernel paging request\") on every affected interface teardown, a full denial of service on the router."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/ethernet/mediatek/mtk_wed.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "799684448e3e1f57257a6155541e53510488f67b",
|
|
"lessThan": "326a89321f9d5fe399fe6f9ff7c0fc766582a6a0",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "799684448e3e1f57257a6155541e53510488f67b",
|
|
"lessThan": "b453a4bbda03aa8741279c360ac82d1c3ac33548",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "799684448e3e1f57257a6155541e53510488f67b",
|
|
"lessThan": "db1b4bedb9b97c6d34b03d03815147c04fffe8b4",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/ethernet/mediatek/mtk_wed.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.2",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.2",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.48",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.10.7",
|
|
"lessThanOrEqual": "6.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.11",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "6.6.48"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "6.10.7"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "6.11"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/326a89321f9d5fe399fe6f9ff7c0fc766582a6a0"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b453a4bbda03aa8741279c360ac82d1c3ac33548"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/db1b4bedb9b97c6d34b03d03815147c04fffe8b4"
|
|
}
|
|
],
|
|
"title": "net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2024-09-04T20:19:10.367821Z",
|
|
"id": "CVE-2024-44997",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2024-09-04T20:19:22.792Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |