0.0
NA
CVE-2024-53156
"Ath9k HTC Endpoint Bounds Vulnerability"
Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() I found the following bug in my fuzzer: UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51 index 255 is out of range for type 'htc_endpoint [22]' CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.11.0-rc6-dirty #14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: events request_firmware_work_func Call Trace: <TASK> dump_stack_lvl+0x180/0x1b0 __ubsan_handle_out_of_bounds+0xd4/0x130 htc_issue_send.constprop.0+0x20c/0x230 ? _raw_spin_unlock_irqrestore+0x3c/0x70 ath9k_wmi_cmd+0x41d/0x610 ? mark_held_locks+0x9f/0xe0 ... Since this bug has been confirmed to be caused by insufficient verification of conn_rsp_epid, I think it would be appropriate to add a range check for conn_rsp_epid to htc_connect_service() to prevent the bug from occurring.

INFO

Published Date :

Dec. 24, 2024, 12:15 p.m.

Last Modified :

Dec. 24, 2024, 12:15 p.m.

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Remotely Exploitable :

No

Impact Score :

Exploitability Score :

Affected Products

The following products are affected by CVE-2024-53156 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
: Total Affected Vendor : 1 | Products : 1
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-53156.

URL Resource
https://git.kernel.org/stable/c/3fe99b9690b99606d3743c9961ebee865cfa1ab8
https://git.kernel.org/stable/c/5f177fb9d01355ac183e65ad8909ea8ef734e0cf
https://git.kernel.org/stable/c/70eae50d2156cb6e078d0d78809b49bf2f4c7540
https://git.kernel.org/stable/c/8619593634cbdf5abf43f5714df49b04e4ef09ab
https://git.kernel.org/stable/c/8965db7fe2e913ee0802b05fc94c6d6aa74e0596
https://git.kernel.org/stable/c/b6551479daf2bfa80bfd5d9016b02a810e508bfb
https://git.kernel.org/stable/c/bc981179ab5d1a2715f35e3db4e4bb822bacc849
https://git.kernel.org/stable/c/c941af142200d975dd3be632aeb490f4cb91dae4
https://git.kernel.org/stable/c/cb480ae80fd4d0f1ac9e107ce799183beee5124b

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-53156 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2024-53156 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Dec. 24, 2024

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() I found the following bug in my fuzzer: UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51 index 255 is out of range for type 'htc_endpoint [22]' CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.11.0-rc6-dirty #14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: events request_firmware_work_func Call Trace: <TASK> dump_stack_lvl+0x180/0x1b0 __ubsan_handle_out_of_bounds+0xd4/0x130 htc_issue_send.constprop.0+0x20c/0x230 ? _raw_spin_unlock_irqrestore+0x3c/0x70 ath9k_wmi_cmd+0x41d/0x610 ? mark_held_locks+0x9f/0xe0 ... Since this bug has been confirmed to be caused by insufficient verification of conn_rsp_epid, I think it would be appropriate to add a range check for conn_rsp_epid to htc_connect_service() to prevent the bug from occurring.
    Added Reference https://git.kernel.org/stable/c/3fe99b9690b99606d3743c9961ebee865cfa1ab8
    Added Reference https://git.kernel.org/stable/c/5f177fb9d01355ac183e65ad8909ea8ef734e0cf
    Added Reference https://git.kernel.org/stable/c/70eae50d2156cb6e078d0d78809b49bf2f4c7540
    Added Reference https://git.kernel.org/stable/c/8619593634cbdf5abf43f5714df49b04e4ef09ab
    Added Reference https://git.kernel.org/stable/c/8965db7fe2e913ee0802b05fc94c6d6aa74e0596
    Added Reference https://git.kernel.org/stable/c/b6551479daf2bfa80bfd5d9016b02a810e508bfb
    Added Reference https://git.kernel.org/stable/c/bc981179ab5d1a2715f35e3db4e4bb822bacc849
    Added Reference https://git.kernel.org/stable/c/c941af142200d975dd3be632aeb490f4cb91dae4
    Added Reference https://git.kernel.org/stable/c/cb480ae80fd4d0f1ac9e107ce799183beee5124b
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2024-53156 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2024-53156 weaknesses.

NONE - Vulnerability Scoring System
: