CVE-2024-40930 (GCVE-0-2024-40930)
Vulnerability from cvelistv5
Published
2024-07-12 12:25
Modified
2026-08-05 11:34
Severity ?
7.1 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate HE operation element parsing Validate that the HE operation element has the correct length before parsing it.
References
Impacted products
Vendor Product Version
Linux Linux Version: 645f3d85129d8aac3b896ba685fbc20a31c2c036
Version: 645f3d85129d8aac3b896ba685fbc20a31c2c036
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:39:55.787Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f15e3e13e14cc5ae8f950c16efe706add18ac8e2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4dc3a3893dae5a7f73e5809273aca0f1f3548d55"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40930",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:05:02.066310Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:02.818Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f15e3e13e14cc5ae8f950c16efe706add18ac8e2",
              "status": "affected",
              "version": "645f3d85129d8aac3b896ba685fbc20a31c2c036",
              "versionType": "git"
            },
            {
              "lessThan": "4dc3a3893dae5a7f73e5809273aca0f1f3548d55",
              "status": "affected",
              "version": "645f3d85129d8aac3b896ba685fbc20a31c2c036",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.6",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: validate HE operation element parsing\n\nValidate that the HE operation element has the correct\nlength before parsing it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerability is triggered by parsing the HE Operation element of a raw 802.11 beacon or probe response received over the air, requiring the attacker only to be within radio range on a 6 GHz channel. This is classic WiFi frame injection, which maps to Adjacent.\nAC:L - The attacker deterministically crafts a 7-byte HE Operation element with the 6GHZ_OP_INFO, VHT_OPER_INFO and CO_HOSTED_BSS bits set in he_oper_params, which unconditionally drives the read past the element end; there is no race and no unknown state to win. The victim merely needs a 6 GHz-capable radio performing a scan, which is automatic, routine behavior.\nPR:N - Beacons and 6 GHz broadcast probe responses are parsed during scanning with no authentication, association, or key exchange whatsoever \u2014 ieee80211_scan_rx() accepts them from any BSSID. The attacker needs no credentials or account on the target.\nUI:N - Background and connection-triggered scans run automatically on WiFi clients and APs, so the malicious frame is ingested with no victim action. The user never has to select or connect to the rogue AP.\nS:U - The out-of-bounds read stays within kernel memory managed by the same security authority as the vulnerable cfg80211 code. No VM, IOMMU, or sandbox boundary is crossed.\nC:L - A single byte is read up to five bytes past the end of the received frame buffer, and its REG_INFO bits steer the BSS use_for/cannot_use_reasons flags that cfg80211 exports to userspace via nl80211 \u2014 giving a repeatable few-bit oracle on adjacent kernel memory. The disclosure is real but strictly bounded to one byte at a fixed small offset, so Low rather than High.\nI:N - The bug is a pure read with no out-of-bounds write, no freed-object reuse, and no type confusion, so no attacker-controlled memory modification is possible. The only state it influences is a usability flag on a BSS whose contents the attacker already fully controls.\nA:H - This is a memory-safety violation reading beyond the frame buffer, which produces a KASAN report (a panic under panic_on_warn or kasan.fault=panic, and a trap under Android arm64 MTE) and can fault outright if the buffer ends at a page boundary. An unauthenticated attacker can replay the malformed beacon continuously, so any resulting oops is trivially repeatable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:34:06.321Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f15e3e13e14cc5ae8f950c16efe706add18ac8e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/4dc3a3893dae5a7f73e5809273aca0f1f3548d55"
        }
      ],
      "title": "wifi: cfg80211: validate HE operation element parsing",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40930",
    "datePublished": "2024-07-12T12:25:09.110Z",
    "dateReserved": "2024-07-12T12:17:45.583Z",
    "dateUpdated": "2026-08-05T11:34:06.321Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f15e3e13e14cc5ae8f950c16efe706add18ac8e2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4dc3a3893dae5a7f73e5809273aca0f1f3548d55\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:39:55.787Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-40930\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:05:02.066310Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:14.221Z\"}}], \"cna\": {\"title\": \"wifi: cfg80211: validate HE operation element parsing\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:A - The vulnerability is triggered by parsing the HE Operation element of a raw 802.11 beacon or probe response received over the air, requiring the attacker only to be within radio range on a 6 GHz channel. This is classic WiFi frame injection, which maps to Adjacent.\\nAC:L - The attacker deterministically crafts a 7-byte HE Operation element with the 6GHZ_OP_INFO, VHT_OPER_INFO and CO_HOSTED_BSS bits set in he_oper_params, which unconditionally drives the read past the element end; there is no race and no unknown state to win. The victim merely needs a 6 GHz-capable radio performing a scan, which is automatic, routine behavior.\\nPR:N - Beacons and 6 GHz broadcast probe responses are parsed during scanning with no authentication, association, or key exchange whatsoever \\u2014 ieee80211_scan_rx() accepts them from any BSSID. The attacker needs no credentials or account on the target.\\nUI:N - Background and connection-triggered scans run automatically on WiFi clients and APs, so the malicious frame is ingested with no victim action. The user never has to select or connect to the rogue AP.\\nS:U - The out-of-bounds read stays within kernel memory managed by the same security authority as the vulnerable cfg80211 code. No VM, IOMMU, or sandbox boundary is crossed.\\nC:L - A single byte is read up to five bytes past the end of the received frame buffer, and its REG_INFO bits steer the BSS use_for/cannot_use_reasons flags that cfg80211 exports to userspace via nl80211 \\u2014 giving a repeatable few-bit oracle on adjacent kernel memory. The disclosure is real but strictly bounded to one byte at a fixed small offset, so Low rather than High.\\nI:N - The bug is a pure read with no out-of-bounds write, no freed-object reuse, and no type confusion, so no attacker-controlled memory modification is possible. The only state it influences is a usability flag on a BSS whose contents the attacker already fully controls.\\nA:H - This is a memory-safety violation reading beyond the frame buffer, which produces a KASAN report (a panic under panic_on_warn or kasan.fault=panic, and a trap under Android arm64 MTE) and can fault outright if the buffer ends at a page boundary. An unauthenticated attacker can replay the malformed beacon continuously, so any resulting oops is trivially repeatable.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"645f3d85129d8aac3b896ba685fbc20a31c2c036\", \"lessThan\": \"f15e3e13e14cc5ae8f950c16efe706add18ac8e2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"645f3d85129d8aac3b896ba685fbc20a31c2c036\", \"lessThan\": \"4dc3a3893dae5a7f73e5809273aca0f1f3548d55\", \"versionType\": \"git\"}], \"programFiles\": [\"net/wireless/scan.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.9.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/wireless/scan.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f15e3e13e14cc5ae8f950c16efe706add18ac8e2\"}, {\"url\": \"https://git.kernel.org/stable/c/4dc3a3893dae5a7f73e5809273aca0f1f3548d55\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: cfg80211: validate HE operation element parsing\\n\\nValidate that the HE operation element has the correct\\nlength before parsing it.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.6\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"6.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:34:06.321Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-40930\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:34:06.321Z\", \"dateReserved\": \"2024-07-12T12:17:45.583Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-12T12:25:09.110Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.