CVE-2024-38572
wifi: ath12k: fix out-of-bound access of qmi_invoke_handler()
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bound access of qmi_invoke_handler() Currently, there is no terminator entry for ath12k_qmi_msg_handlers hence facing below KASAN warning, ================================================================== BUG: KASAN: global-out-of-bounds in qmi_invoke_handler+0xa4/0x148 Read of size 8 at addr ffffffd00a6428d8 by task kworker/u8:2/1273 CPU: 0 PID: 1273 Comm: kworker/u8:2 Not tainted 5.4.213 #0 Workqueue: qmi_msg_handler qmi_data_ready_work Call trace: dump_backtrace+0x0/0x20c show_stack+0x14/0x1c dump_stack+0xe0/0x138 print_address_description.isra.5+0x30/0x330 __kasan_report+0x16c/0x1bc kasan_report+0xc/0x14 __asan_load8+0xa8/0xb0 qmi_invoke_handler+0xa4/0x148 qmi_handle_message+0x18c/0x1bc qmi_data_ready_work+0x4ec/0x528 process_one_work+0x2c0/0x440 worker_thread+0x324/0x4b8 kthread+0x210/0x228 ret_from_fork+0x10/0x18 The address belongs to the variable: ath12k_mac_mon_status_filter_default+0x4bd8/0xfffffffffffe2300 [ath12k] [...] ================================================================== Add a dummy terminator entry at the end to assist the qmi_invoke_handler() in traversing up to the terminator entry without accessing an out-of-boundary index. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
INFO
Published Date :
June 19, 2024, 2:15 p.m.
Last Modified :
Sept. 17, 2025, 9:05 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update the affected kernel packages.
- Update the affected packages.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-38572.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-38572 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-38572
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-38572 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-38572 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Sep. 17, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H Added CWE CWE-125 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.9 up to (excluding) 6.9.3 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.8.12 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.3 up to (excluding) 6.6.33 Added Reference Type kernel.org: https://git.kernel.org/stable/c/95575de7dede7b1ed3b9718dab9dda97914ea775 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/95575de7dede7b1ed3b9718dab9dda97914ea775 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a1abdb63628b04855a929850772de97435ed1555 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/a1abdb63628b04855a929850772de97435ed1555 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b48d40f5840c505b7af700594aa8379eec28e925 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/b48d40f5840c505b7af700594aa8379eec28e925 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/e1bdff48a1bb4a4ac660c19c55a820968c48b3f2 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/e1bdff48a1bb4a4ac660c19c55a820968c48b3f2 Types: Patch -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/95575de7dede7b1ed3b9718dab9dda97914ea775 Added Reference https://git.kernel.org/stable/c/a1abdb63628b04855a929850772de97435ed1555 Added Reference https://git.kernel.org/stable/c/b48d40f5840c505b7af700594aa8379eec28e925 Added Reference https://git.kernel.org/stable/c/e1bdff48a1bb4a4ac660c19c55a820968c48b3f2 -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 19, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bound access of qmi_invoke_handler() Currently, there is no terminator entry for ath12k_qmi_msg_handlers hence facing below KASAN warning, ================================================================== BUG: KASAN: global-out-of-bounds in qmi_invoke_handler+0xa4/0x148 Read of size 8 at addr ffffffd00a6428d8 by task kworker/u8:2/1273 CPU: 0 PID: 1273 Comm: kworker/u8:2 Not tainted 5.4.213 #0 Workqueue: qmi_msg_handler qmi_data_ready_work Call trace: dump_backtrace+0x0/0x20c show_stack+0x14/0x1c dump_stack+0xe0/0x138 print_address_description.isra.5+0x30/0x330 __kasan_report+0x16c/0x1bc kasan_report+0xc/0x14 __asan_load8+0xa8/0xb0 qmi_invoke_handler+0xa4/0x148 qmi_handle_message+0x18c/0x1bc qmi_data_ready_work+0x4ec/0x528 process_one_work+0x2c0/0x440 worker_thread+0x324/0x4b8 kthread+0x210/0x228 ret_from_fork+0x10/0x18 The address belongs to the variable: ath12k_mac_mon_status_filter_default+0x4bd8/0xfffffffffffe2300 [ath12k] [...] ================================================================== Add a dummy terminator entry at the end to assist the qmi_invoke_handler() in traversing up to the terminator entry without accessing an out-of-boundary index. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Added Reference kernel.org https://git.kernel.org/stable/c/95575de7dede7b1ed3b9718dab9dda97914ea775 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/b48d40f5840c505b7af700594aa8379eec28e925 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/a1abdb63628b04855a929850772de97435ed1555 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/e1bdff48a1bb4a4ac660c19c55a820968c48b3f2 [No types assigned]