CVE-2024-50236
"Linux Kernel Ath10k Wi-Fi Memory Leak"
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: Fix memory leak in management tx In the current logic, memory is allocated for storing the MSDU context during management packet TX but this memory is not being freed during management TX completion. Similar leaks are seen in the management TX cleanup logic. Kmemleak reports this problem as below, unreferenced object 0xffffff80b64ed250 (size 16): comm "kworker/u16:7", pid 148, jiffies 4294687130 (age 714.199s) hex dump (first 16 bytes): 00 2b d8 d8 80 ff ff ff c4 74 e9 fd 07 00 00 00 .+.......t...... backtrace: [<ffffffe6e7b245dc>] __kmem_cache_alloc_node+0x1e4/0x2d8 [<ffffffe6e7adde88>] kmalloc_trace+0x48/0x110 [<ffffffe6bbd765fc>] ath10k_wmi_tlv_op_gen_mgmt_tx_send+0xd4/0x1d8 [ath10k_core] [<ffffffe6bbd3eed4>] ath10k_mgmt_over_wmi_tx_work+0x134/0x298 [ath10k_core] [<ffffffe6e78d5974>] process_scheduled_works+0x1ac/0x400 [<ffffffe6e78d60b8>] worker_thread+0x208/0x328 [<ffffffe6e78dc890>] kthread+0x100/0x1c0 [<ffffffe6e78166c0>] ret_from_fork+0x10/0x20 Free the memory during completion and cleanup to fix the leak. Protect the mgmt_pending_tx idr_remove() operation in ath10k_wmi_tlv_op_cleanup_mgmt_tx_send() using ar->data_lock similar to other instances. Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.2.0-01387-QCAHLSWMTPLZ-1
INFO
Published Date :
Nov. 9, 2024, 11:15 a.m.
Last Modified :
Nov. 14, 2024, 4:29 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-50236.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-50236 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-50236 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Nov. 14, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Changed Reference Type https://git.kernel.org/stable/c/2f6f1e26ac6d2b38e2198a71f81f0ade14d6b07b No Types Assigned https://git.kernel.org/stable/c/2f6f1e26ac6d2b38e2198a71f81f0ade14d6b07b Patch Changed Reference Type https://git.kernel.org/stable/c/4112450da7d67b59ccedc2208bae622db17dbcb8 No Types Assigned https://git.kernel.org/stable/c/4112450da7d67b59ccedc2208bae622db17dbcb8 Patch Changed Reference Type https://git.kernel.org/stable/c/5f5a939759c79e7385946c85e62feca51a18d816 No Types Assigned https://git.kernel.org/stable/c/5f5a939759c79e7385946c85e62feca51a18d816 Patch Changed Reference Type https://git.kernel.org/stable/c/6cc23898e6ba47e976050d3c080b4d2c1add3748 No Types Assigned https://git.kernel.org/stable/c/6cc23898e6ba47e976050d3c080b4d2c1add3748 Patch Changed Reference Type https://git.kernel.org/stable/c/6fc9af3df6ca7f3c94774d20f62dc7b49616026d No Types Assigned https://git.kernel.org/stable/c/6fc9af3df6ca7f3c94774d20f62dc7b49616026d Patch Changed Reference Type https://git.kernel.org/stable/c/705be2dc45c7f852e211e16bc41a916fab741983 No Types Assigned https://git.kernel.org/stable/c/705be2dc45c7f852e211e16bc41a916fab741983 Patch Changed Reference Type https://git.kernel.org/stable/c/e15d84b3bba187aa372dff7c58ce1fd5cb48a076 No Types Assigned https://git.kernel.org/stable/c/e15d84b3bba187aa372dff7c58ce1fd5cb48a076 Patch Changed Reference Type https://git.kernel.org/stable/c/eff818238bedb9c2484c251ec46f9f160911cdc0 No Types Assigned https://git.kernel.org/stable/c/eff818238bedb9c2484c251ec46f9f160911cdc0 Patch Added CWE NIST CWE-401 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.19 up to (excluding) 4.19.323 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.285 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.229 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.171 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.116 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.60 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.11.7 *cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:* -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Nov. 09, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: Fix memory leak in management tx In the current logic, memory is allocated for storing the MSDU context during management packet TX but this memory is not being freed during management TX completion. Similar leaks are seen in the management TX cleanup logic. Kmemleak reports this problem as below, unreferenced object 0xffffff80b64ed250 (size 16): comm "kworker/u16:7", pid 148, jiffies 4294687130 (age 714.199s) hex dump (first 16 bytes): 00 2b d8 d8 80 ff ff ff c4 74 e9 fd 07 00 00 00 .+.......t...... backtrace: [<ffffffe6e7b245dc>] __kmem_cache_alloc_node+0x1e4/0x2d8 [<ffffffe6e7adde88>] kmalloc_trace+0x48/0x110 [<ffffffe6bbd765fc>] ath10k_wmi_tlv_op_gen_mgmt_tx_send+0xd4/0x1d8 [ath10k_core] [<ffffffe6bbd3eed4>] ath10k_mgmt_over_wmi_tx_work+0x134/0x298 [ath10k_core] [<ffffffe6e78d5974>] process_scheduled_works+0x1ac/0x400 [<ffffffe6e78d60b8>] worker_thread+0x208/0x328 [<ffffffe6e78dc890>] kthread+0x100/0x1c0 [<ffffffe6e78166c0>] ret_from_fork+0x10/0x20 Free the memory during completion and cleanup to fix the leak. Protect the mgmt_pending_tx idr_remove() operation in ath10k_wmi_tlv_op_cleanup_mgmt_tx_send() using ar->data_lock similar to other instances. Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.2.0-01387-QCAHLSWMTPLZ-1 Added Reference kernel.org https://git.kernel.org/stable/c/eff818238bedb9c2484c251ec46f9f160911cdc0 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/6fc9af3df6ca7f3c94774d20f62dc7b49616026d [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/4112450da7d67b59ccedc2208bae622db17dbcb8 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/705be2dc45c7f852e211e16bc41a916fab741983 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/6cc23898e6ba47e976050d3c080b4d2c1add3748 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/5f5a939759c79e7385946c85e62feca51a18d816 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/2f6f1e26ac6d2b38e2198a71f81f0ade14d6b07b [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/e15d84b3bba187aa372dff7c58ce1fd5cb48a076 [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-50236 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-50236
weaknesses.