CVE-2024-49931

wifi: ath12k: fix array out-of-bound access in SoC stats

published October 21, 2024

CVSS
—
EPSS
0%
Percentile
14.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix array out-of-bound access in SoC stats

Currently, the ath12k_soc_dp_stats::hal_reo_error array is defined with a

maximum size of DP_REO_DST_RING_MAX. However, the ath12k_dp_rx_process()

function access ath12k_soc_dp_stats::hal_reo_error using the REO

destination SRNG ring ID, which is incorrect. SRNG ring ID differ from

normal ring ID, and this usage leads to out-of-bounds array access. To

fix this issue, modify ath12k_dp_rx_process() to use the normal ring ID

directly instead of the SRNG ring ID to avoid out-of-bounds array access.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00244 · 14.7th percentile
Published
2024-10-21T18:01Z
EPSS history
Timeline
  • 21 OCT 18:01Z
    wifi: ath12k: fix array out-of-bound access in SoC stats
    cvelistv5