CVE-2024-26896

wifi: wfx: fix memory leak when starting AP

published April 17, 2024

CVSS
—
EPSS
0%
Percentile
12.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

wifi: wfx: fix memory leak when starting AP

Kmemleak reported this error:

unreferenced object 0xd73d1180 (size 184):

comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.245s)

hex dump (first 32 bytes):

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00 00 00 00 00 00 00 00 1e 00 01 00 00 00 00 00 ................

backtrace:

[<5ca11420>] kmem_cache_alloc+0x20c/0x5ac

[<127bdd74>] __alloc_skb+0x144/0x170

[<fb8a5e38>] __netdev_alloc_skb+0x50/0x180

[<0f9fa1d5>] __ieee80211_beacon_get+0x290/0x4d4 [mac80211]

[<7accd02d>] ieee80211_beacon_get_tim+0x54/0x18c [mac80211]

[<41e25cc3>] wfx_start_ap+0xc8/0x234 [wfx]

[<93a70356>] ieee80211_start_ap+0x404/0x6b4 [mac80211]

[<a4a661cd>] nl80211_start_ap+0x76c/0x9e0 [cfg80211]

[<47bd8b68>] genl_rcv_msg+0x198/0x378

[<453ef796>] netlink_rcv_skb+0xd0/0x130

[<6b7c977a>] genl_rcv+0x34/0x44

[<66b2d04d>] netlink_unicast+0x1b4/0x258

[<f965b9b6>] netlink_sendmsg+0x1e8/0x428

[<aadb8231>] ____sys_sendmsg+0x1e0/0x274

[<d2b5212d>] ___sys_sendmsg+0x80/0xb4

[<69954f45>] __sys_sendmsg+0x64/0xa8

unreferenced object 0xce087000 (size 1024):

comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.246s)

hex dump (first 32 bytes):

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

10 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............

backtrace:

[<9a993714>] __kmalloc_track_caller+0x230/0x600

[<f83ea192>] kmalloc_reserve.constprop.0+0x30/0x74

[<a2c61343>] __alloc_skb+0xa0/0x170

[<fb8a5e38>] __netdev_alloc_skb+0x50/0x180

[<0f9fa1d5>] __ieee80211_beacon_get+0x290/0x4d4 [mac80211]

[<7accd02d>] ieee80211_beacon_get_tim+0x54/0x18c [mac80211]

[<41e25cc3>] wfx_start_ap+0xc8/0x234 [wfx]

[<93a70356>] ieee80211_start_ap+0x404/0x6b4 [mac80211]

[<a4a661cd>] nl80211_start_ap+0x76c/0x9e0 [cfg80211]

[<47bd8b68>] genl_rcv_msg+0x198/0x378

[<453ef796>] netlink_rcv_skb+0xd0/0x130

[<6b7c977a>] genl_rcv+0x34/0x44

[<66b2d04d>] netlink_unicast+0x1b4/0x258

[<f965b9b6>] netlink_sendmsg+0x1e8/0x428

[<aadb8231>] ____sys_sendmsg+0x1e0/0x274

[<d2b5212d>] ___sys_sendmsg+0x80/0xb4

However, since the kernel is build optimized, it seems the stack is not

accurate. It appears the issue is related to wfx_set_mfp_ap(). The issue

is obvious in this function: memory allocated by ieee80211_beacon_get()

is never released. Fixing this leak makes kmemleak happy.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00225 · 12.5th percentile
Published
2024-04-17T10:27Z
EPSS history
Timeline
  • 17 APR 10:27Z
    wifi: wfx: fix memory leak when starting AP
    cvelistv5