CVE-2024-49929 (GCVE-0-2024-49929)
Vulnerability from cvelistv5
Published
2024-10-21 18:01
Modified
2025-11-03 20:42
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: avoid NULL pointer dereference iwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu() verify that the mvmvsta pointer is not NULL. It retrieves this pointer using iwl_mvm_sta_from_mac80211, which is dereferencing the ieee80211_sta pointer. If sta is NULL, iwl_mvm_sta_from_mac80211 will dereference a NULL pointer. Fix this by checking the sta pointer before retrieving the mvmsta from it. If sta is not NULL, then mvmsta isn't either.
References
Impacted products
Vendor Product Version
Linux Linux Version: 5b577a90fb3d86447ee86f8e0c6ddbd5da2ef8c9
Version: 5b577a90fb3d86447ee86f8e0c6ddbd5da2ef8c9
Version: 5b577a90fb3d86447ee86f8e0c6ddbd5da2ef8c9
Version: 5b577a90fb3d86447ee86f8e0c6ddbd5da2ef8c9
Version: 5b577a90fb3d86447ee86f8e0c6ddbd5da2ef8c9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49929",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:39:18.933944Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:48:43.528Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:42:04.998Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/mvm/tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cbc6fc9cfcde151ff5eadaefdc6155f99579384f",
              "status": "affected",
              "version": "5b577a90fb3d86447ee86f8e0c6ddbd5da2ef8c9",
              "versionType": "git"
            },
            {
              "lessThan": "6dcadb2ed3b76623ab96e3e7fbeda1a374d01c28",
              "status": "affected",
              "version": "5b577a90fb3d86447ee86f8e0c6ddbd5da2ef8c9",
              "versionType": "git"
            },
            {
              "lessThan": "cdbf51bfa4b0411820806777da36d93d49bc49a1",
              "status": "affected",
              "version": "5b577a90fb3d86447ee86f8e0c6ddbd5da2ef8c9",
              "versionType": "git"
            },
            {
              "lessThan": "c0b4f5d94934c290479180868a32c15ba36a6d9e",
              "status": "affected",
              "version": "5b577a90fb3d86447ee86f8e0c6ddbd5da2ef8c9",
              "versionType": "git"
            },
            {
              "lessThan": "557a6cd847645e667f3b362560bd7e7c09aac284",
              "status": "affected",
              "version": "5b577a90fb3d86447ee86f8e0c6ddbd5da2ef8c9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/mvm/tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.14"
            },
            {
              "lessThan": "3.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.55",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.14",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.3",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: avoid NULL pointer dereference\n\niwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu() verify that the mvmvsta\npointer is not NULL.\nIt retrieves this pointer using iwl_mvm_sta_from_mac80211, which is\ndereferencing the ieee80211_sta pointer.\nIf sta is NULL, iwl_mvm_sta_from_mac80211 will dereference a NULL\npointer.\nFix this by checking the sta pointer before retrieving the mvmsta\nfrom it. If sta is not NULL, then mvmsta isn\u0027t either."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-21T09:13:23.151Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cbc6fc9cfcde151ff5eadaefdc6155f99579384f"
        },
        {
          "url": "https://git.kernel.org/stable/c/6dcadb2ed3b76623ab96e3e7fbeda1a374d01c28"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdbf51bfa4b0411820806777da36d93d49bc49a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0b4f5d94934c290479180868a32c15ba36a6d9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/557a6cd847645e667f3b362560bd7e7c09aac284"
        }
      ],
      "title": "wifi: iwlwifi: mvm: avoid NULL pointer dereference",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49929",
    "datePublished": "2024-10-21T18:01:52.450Z",
    "dateReserved": "2024-10-21T12:17:06.039Z",
    "dateUpdated": "2025-11-03T20:42:04.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49929\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:39:18.933944Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:39:21.998Z\"}}], \"cna\": {\"title\": \"wifi: iwlwifi: mvm: avoid NULL pointer dereference\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5b577a90fb3d86447ee86f8e0c6ddbd5da2ef8c9\", \"lessThan\": \"cbc6fc9cfcde151ff5eadaefdc6155f99579384f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5b577a90fb3d86447ee86f8e0c6ddbd5da2ef8c9\", \"lessThan\": \"6dcadb2ed3b76623ab96e3e7fbeda1a374d01c28\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5b577a90fb3d86447ee86f8e0c6ddbd5da2ef8c9\", \"lessThan\": \"cdbf51bfa4b0411820806777da36d93d49bc49a1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5b577a90fb3d86447ee86f8e0c6ddbd5da2ef8c9\", \"lessThan\": \"c0b4f5d94934c290479180868a32c15ba36a6d9e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5b577a90fb3d86447ee86f8e0c6ddbd5da2ef8c9\", \"lessThan\": \"557a6cd847645e667f3b362560bd7e7c09aac284\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/wireless/intel/iwlwifi/mvm/tx.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.120\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.55\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/wireless/intel/iwlwifi/mvm/tx.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/cbc6fc9cfcde151ff5eadaefdc6155f99579384f\"}, {\"url\": \"https://git.kernel.org/stable/c/6dcadb2ed3b76623ab96e3e7fbeda1a374d01c28\"}, {\"url\": \"https://git.kernel.org/stable/c/cdbf51bfa4b0411820806777da36d93d49bc49a1\"}, {\"url\": \"https://git.kernel.org/stable/c/c0b4f5d94934c290479180868a32c15ba36a6d9e\"}, {\"url\": \"https://git.kernel.org/stable/c/557a6cd847645e667f3b362560bd7e7c09aac284\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: iwlwifi: mvm: avoid NULL pointer dereference\\n\\niwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu() verify that the mvmvsta\\npointer is not NULL.\\nIt retrieves this pointer using iwl_mvm_sta_from_mac80211, which is\\ndereferencing the ieee80211_sta pointer.\\nIf sta is NULL, iwl_mvm_sta_from_mac80211 will dereference a NULL\\npointer.\\nFix this by checking the sta pointer before retrieving the mvmsta\\nfrom it. If sta is not NULL, then mvmsta isn\u0027t either.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.120\", \"versionStartIncluding\": \"3.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.55\", \"versionStartIncluding\": \"3.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.14\", \"versionStartIncluding\": \"3.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.3\", \"versionStartIncluding\": \"3.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"3.14\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-21T09:13:23.151Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49929\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-21T09:13:23.151Z\", \"dateReserved\": \"2024-10-21T12:17:06.039Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T18:01:52.450Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.