CVE-2024-43881 (GCVE-0-2024-43881)
Vulnerability from cvelistv5
Published
2024-08-21 00:06
Modified
2026-08-05 11:36
Severity ?
8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: change DMA direction while mapping reinjected packets For fragmented packets, ath12k reassembles each fragment as a normal packet and then reinjects it into HW ring. In this case, the DMA direction should be DMA_TO_DEVICE, not DMA_FROM_DEVICE. Otherwise, an invalid payload may be reinjected into the HW and subsequently delivered to the host. Given that arbitrary memory can be allocated to the skb buffer, knowledge about the data contained in the reinjected buffer is lacking. Consequently, there’s a risk of private information being leaked. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1
References
Impacted products
Vendor Product Version
Linux Linux Version: d889913205cf7ebda905b1e62c5867ed4e39f6c2
Version: d889913205cf7ebda905b1e62c5867ed4e39f6c2
Version: d889913205cf7ebda905b1e62c5867ed4e39f6c2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43881",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:05:47.970201Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:15.718Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/dp_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e99d9b16ff153de9540073239d24adc3b0a3a997",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            },
            {
              "lessThan": "6925320fcd40d8042d32bf4ede8248e7a5315c3b",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            },
            {
              "lessThan": "33322e3ef07409278a18c6919c448e369d66a18e",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/dp_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.44",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: change DMA direction while mapping reinjected packets\n\nFor fragmented packets, ath12k reassembles each fragment as a normal\npacket and then reinjects it into HW ring. In this case, the DMA\ndirection should be DMA_TO_DEVICE, not DMA_FROM_DEVICE. Otherwise,\nan invalid payload may be reinjected into the HW and\nsubsequently delivered to the host.\n\nGiven that arbitrary memory can be allocated to the skb buffer,\nknowledge about the data contained in the reinjected buffer is lacking.\nConsequently, there\u2019s a risk of private information being leaked.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The trigger is a sequence of fragmented 802.11 data frames received over the air by the ath12k Wi-Fi driver, processed in the REO exception/defrag RX path. This requires the attacker to be within radio range on the same WLAN segment, which is CVSS Adjacent.\nAC:L - The attacker fully controls the trigger \u2014 simply send a fragmented MPDU sequence \u2014 with no race to win and no memory layout dependency; sizing the fragments above DP_RX_BUFFER_SIZE + tailroom deterministically forces the pskb_expand_head() path so the reinjected buffer is freshly allocated uninitialized heap. The affected platform class (DMA-noncoherent embedded ARM APs and SWIOTLB-bounced systems) is the primary deployment target for QCN9274/ath12k.\nPR:N - No privileges on the host are needed; the attacker only needs to be a peer sending fragments, and ath12k_dp_rx_h_defrag_validate_incr_pn() returns true unconditionally for non-CCMP/GCMP encryption, so open/guest/hotspot SSIDs and rogue-AP-against-STA scenarios have no authentication gate on this path.\nUI:N - The vulnerable code runs in the NAPI receive path and executes automatically on arrival of fragmented frames. No local user action of any kind is required.\nS:U - The mis-directioned DMA mapping and its consequences are confined to the kernel\u0027s own memory and the driver\u0027s RX pipeline, all within the same security authority. There is no VM, IOMMU, or sandbox boundary crossed.\nC:H - Up to a full RX buffer of arbitrary uninitialized kernel slab memory (recently freed heap that may contain keys, kernel pointers, or other packets\u0027 data) is handed to the Wi-Fi hardware and re-delivered as network payload, repeatably at frame rate; in the standard AP/bridge/repeater deployment it is forwarded onto the LAN or back over the air where the attacker can capture it. The upstream fix explicitly cites leakage of private information.\nI:H - The legitimate reassembled frame is silently replaced with unrelated memory that mac80211 accepts flagged RX_FLAG_DECRYPTED | RX_FLAG_PN_VALIDATED, i.e. arbitrary content is injected into the host\u0027s network stack and bridge as authenticated data from a trusted peer, bypassing link-layer integrity protection; an attacker able to groom the kernel heap can influence that content.\nA:H - The returned buffer is parsed as a hardware RX descriptor while containing uninitialized heap, and the is_frag branch in ath12k_dp_rx_process_msdu() skips the msdu_len bounds check, driving skb_pull/skb_push/memmove and rate decoding from garbage \u2014 e.g. nss==0 underflows rate_idx to \u003e2000 and trips mac80211\u0027s WARN_ON, which panics on panic_on_warn systems, alongside continuous RX-path corruption and frame loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:56.662Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e99d9b16ff153de9540073239d24adc3b0a3a997"
        },
        {
          "url": "https://git.kernel.org/stable/c/6925320fcd40d8042d32bf4ede8248e7a5315c3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/33322e3ef07409278a18c6919c448e369d66a18e"
        }
      ],
      "title": "wifi: ath12k: change DMA direction while mapping reinjected packets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-43881",
    "datePublished": "2024-08-21T00:06:33.622Z",
    "dateReserved": "2024-08-17T09:11:59.287Z",
    "dateUpdated": "2026-08-05T11:36:56.662Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43881\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:05:47.970201Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:19.051Z\"}}], \"cna\": {\"title\": \"wifi: ath12k: change DMA direction while mapping reinjected packets\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d889913205cf7ebda905b1e62c5867ed4e39f6c2\", \"lessThan\": \"e99d9b16ff153de9540073239d24adc3b0a3a997\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d889913205cf7ebda905b1e62c5867ed4e39f6c2\", \"lessThan\": \"6925320fcd40d8042d32bf4ede8248e7a5315c3b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d889913205cf7ebda905b1e62c5867ed4e39f6c2\", \"lessThan\": \"33322e3ef07409278a18c6919c448e369d66a18e\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/wireless/ath/ath12k/dp_rx.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.3\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.3\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.44\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/wireless/ath/ath12k/dp_rx.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e99d9b16ff153de9540073239d24adc3b0a3a997\"}, {\"url\": \"https://git.kernel.org/stable/c/6925320fcd40d8042d32bf4ede8248e7a5315c3b\"}, {\"url\": \"https://git.kernel.org/stable/c/33322e3ef07409278a18c6919c448e369d66a18e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath12k: change DMA direction while mapping reinjected packets\\n\\nFor fragmented packets, ath12k reassembles each fragment as a normal\\npacket and then reinjects it into HW ring. In this case, the DMA\\ndirection should be DMA_TO_DEVICE, not DMA_FROM_DEVICE. Otherwise,\\nan invalid payload may be reinjected into the HW and\\nsubsequently delivered to the host.\\n\\nGiven that arbitrary memory can be allocated to the skb buffer,\\nknowledge about the data contained in the reinjected buffer is lacking.\\nConsequently, there\\u2019s a risk of private information being leaked.\\n\\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.44\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.3\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"6.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:31:37.987Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-43881\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:31:37.987Z\", \"dateReserved\": \"2024-08-17T09:11:59.287Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-21T00:06:33.622Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.