In the Linux kernel, the following vulnerability has been resolved:
wifi: wilc1000: fix potential RCU dereference issue in wilcparsejoinbssparam
In the wilc_parse_join_bss_param function, the TSF field of the ies
structure is accessed after the RCU read-side critical section is
unlocked. According to RCU usage rules, this is illegal. Reusing this
pointer can lead to unpredictable behavior, including accessing memory
that has been updated or causing use-after-free issues.
This possible bug was identified using a static analysis tool developed by myself, specifically designed to detect RCU-related issues.
To address this, the TSF value is now stored in a local variable
ies_tsf before the RCU lock is released. The param->tsf_lo field is
then assigned using this local variable, ensuring that the TSF value is
safely accessed.
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"241489250093182238891380460831029783098",
"330760705327770292962539712331819006104",
"218495249862573302033920910885160804122",
"187740817791350336890311465928143828601",
"338557790966821075736979630267176761600",
"88445788088583726458492384968021752280",
"90660618498338466694385883380859761822",
"259293618668256030484348043873557668472",
"106258218903777435074381097919346368908",
"253066868448634684398302939221151746877",
"336084614108169705369794720569507584165",
"182762397595348691150413568779434618964"
]
},
"id": "CVE-2024-47712-16e99d67",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d7c6ae1efb1ff68bc01d79d94fdf0388f86cdd8",
"target": {
"file": "drivers/net/wireless/microchip/wilc1000/hif.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 3911.0,
"function_hash": "181912356653759510409113873380677105770"
},
"id": "CVE-2024-47712-2b4cfb7e",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@79510414a7626317f13cc9073244ab7a8deb3192",
"target": {
"file": "drivers/net/wireless/microchip/wilc1000/hif.c",
"function": "wilc_parse_join_bss_param"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 3911.0,
"function_hash": "181912356653759510409113873380677105770"
},
"id": "CVE-2024-47712-388fb3ab",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84398204c5df5aaf89453056cf0647cda9664d2b",
"target": {
"file": "drivers/net/wireless/microchip/wilc1000/hif.c",
"function": "wilc_parse_join_bss_param"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"241489250093182238891380460831029783098",
"330760705327770292962539712331819006104",
"218495249862573302033920910885160804122",
"187740817791350336890311465928143828601",
"338557790966821075736979630267176761600",
"88445788088583726458492384968021752280",
"90660618498338466694385883380859761822",
"259293618668256030484348043873557668472",
"106258218903777435074381097919346368908",
"253066868448634684398302939221151746877",
"336084614108169705369794720569507584165",
"182762397595348691150413568779434618964"
]
},
"id": "CVE-2024-47712-4350d627",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@557418e1704605a81c9e26732449f71b1d40ba1e",
"target": {
"file": "drivers/net/wireless/microchip/wilc1000/hif.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"241489250093182238891380460831029783098",
"330760705327770292962539712331819006104",
"218495249862573302033920910885160804122",
"187740817791350336890311465928143828601",
"338557790966821075736979630267176761600",
"88445788088583726458492384968021752280",
"90660618498338466694385883380859761822",
"259293618668256030484348043873557668472",
"106258218903777435074381097919346368908",
"253066868448634684398302939221151746877",
"336084614108169705369794720569507584165",
"182762397595348691150413568779434618964"
]
},
"id": "CVE-2024-47712-6dbd0ce2",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@79510414a7626317f13cc9073244ab7a8deb3192",
"target": {
"file": "drivers/net/wireless/microchip/wilc1000/hif.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 3911.0,
"function_hash": "181912356653759510409113873380677105770"
},
"id": "CVE-2024-47712-7c3c5f83",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@557418e1704605a81c9e26732449f71b1d40ba1e",
"target": {
"file": "drivers/net/wireless/microchip/wilc1000/hif.c",
"function": "wilc_parse_join_bss_param"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 3911.0,
"function_hash": "181912356653759510409113873380677105770"
},
"id": "CVE-2024-47712-87892058",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf090f4fe935294361eabd9dc5a949fdd77d3d1b",
"target": {
"file": "drivers/net/wireless/microchip/wilc1000/hif.c",
"function": "wilc_parse_join_bss_param"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"241489250093182238891380460831029783098",
"330760705327770292962539712331819006104",
"218495249862573302033920910885160804122",
"187740817791350336890311465928143828601",
"338557790966821075736979630267176761600",
"88445788088583726458492384968021752280",
"90660618498338466694385883380859761822",
"259293618668256030484348043873557668472",
"106258218903777435074381097919346368908",
"253066868448634684398302939221151746877",
"336084614108169705369794720569507584165",
"182762397595348691150413568779434618964"
]
},
"id": "CVE-2024-47712-8c1604c4",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf090f4fe935294361eabd9dc5a949fdd77d3d1b",
"target": {
"file": "drivers/net/wireless/microchip/wilc1000/hif.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 3911.0,
"function_hash": "181912356653759510409113873380677105770"
},
"id": "CVE-2024-47712-9711f3b1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d7c6ae1efb1ff68bc01d79d94fdf0388f86cdd8",
"target": {
"file": "drivers/net/wireless/microchip/wilc1000/hif.c",
"function": "wilc_parse_join_bss_param"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 3805.0,
"function_hash": "278403733014269481349802726559451700381"
},
"id": "CVE-2024-47712-9d6b151d",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a24cedc243ace5ed7c1016f52a7bfc8f5b07815",
"target": {
"file": "drivers/staging/wilc1000/wilc_hif.c",
"function": "wilc_parse_join_bss_param"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"241489250093182238891380460831029783098",
"330760705327770292962539712331819006104",
"218495249862573302033920910885160804122",
"187740817791350336890311465928143828601",
"338557790966821075736979630267176761600",
"88445788088583726458492384968021752280",
"90660618498338466694385883380859761822",
"259293618668256030484348043873557668472",
"106258218903777435074381097919346368908",
"253066868448634684398302939221151746877",
"336084614108169705369794720569507584165",
"182762397595348691150413568779434618964"
]
},
"id": "CVE-2024-47712-c40a843f",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b040b71d99ee5e17bb7a743dc01cbfcae8908ce1",
"target": {
"file": "drivers/net/wireless/microchip/wilc1000/hif.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"241489250093182238891380460831029783098",
"330760705327770292962539712331819006104",
"218495249862573302033920910885160804122",
"187740817791350336890311465928143828601",
"338557790966821075736979630267176761600",
"88445788088583726458492384968021752280",
"90660618498338466694385883380859761822",
"259293618668256030484348043873557668472",
"106258218903777435074381097919346368908",
"253066868448634684398302939221151746877",
"336084614108169705369794720569507584165",
"182762397595348691150413568779434618964"
]
},
"id": "CVE-2024-47712-ca2d478d",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@84398204c5df5aaf89453056cf0647cda9664d2b",
"target": {
"file": "drivers/net/wireless/microchip/wilc1000/hif.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"241489250093182238891380460831029783098",
"330760705327770292962539712331819006104",
"218495249862573302033920910885160804122",
"187740817791350336890311465928143828601",
"338557790966821075736979630267176761600",
"88445788088583726458492384968021752280",
"90660618498338466694385883380859761822",
"259293618668256030484348043873557668472",
"106258218903777435074381097919346368908",
"253066868448634684398302939221151746877",
"336084614108169705369794720569507584165",
"182762397595348691150413568779434618964"
]
},
"id": "CVE-2024-47712-e6a2f25f",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a24cedc243ace5ed7c1016f52a7bfc8f5b07815",
"target": {
"file": "drivers/staging/wilc1000/wilc_hif.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 3911.0,
"function_hash": "181912356653759510409113873380677105770"
},
"id": "CVE-2024-47712-f0d5bf30",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b040b71d99ee5e17bb7a743dc01cbfcae8908ce1",
"target": {
"file": "drivers/net/wireless/microchip/wilc1000/hif.c",
"function": "wilc_parse_join_bss_param"
}
}
]