CVE-2024-27056 wifi: iwlwifi: mvm: ensure offloading TID queue exists

2024-05-0112:54:56

Linux

github.com

linux kernel

wifi vulnerability

iwlwifi.

7 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.2%

JSON

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: ensure offloading TID queue exists

The resume code path assumes that the TX queue for the offloading TID
has been configured. At resume time it then tries to sync the write
pointer as it may have been updated by the firmware.

In the unusual event that no packets have been send on TID 0, the queue
will not have been allocated and this causes a crash. Fix this by
ensuring the queue exist at suspend time.

CNA Affected

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/net/wireless/intel/iwlwifi/mvm/d3.c",
      "drivers/net/wireless/intel/iwlwifi/mvm/sta.c",
      "drivers/net/wireless/intel/iwlwifi/mvm/sta.h"
    ],
    "versions": [
      {
        "version": "1da177e4c3f4",
        "lessThan": "ed35a509390e",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "1da177e4c3f4",
        "lessThan": "78f65fbf421a",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/net/wireless/intel/iwlwifi/mvm/d3.c",
      "drivers/net/wireless/intel/iwlwifi/mvm/sta.c",
      "drivers/net/wireless/intel/iwlwifi/mvm/sta.h"
    ],
    "versions": [
      {
        "version": "6.7.11",
        "lessThanOrEqual": "6.7.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.8",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]