In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw88: always wait for both firmware loading attempts
In 'rtwwaitfirmwarecompletion()', always wait for both (regular and wowlan) firmware loading attempts. Otherwise if 'rtwusbintfinit()' has failed in 'rtwusbprobe()', 'rtwusbdisconnect()' may issue 'ieee80211freehw()' when one of 'rtwloadfirmware_cb()' (usually the wowlan one) is still in progress, causing UAF detected by KASAN.
[
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 338.0,
"function_hash": "196667861365858665955307364238290292185"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e735a4c6137262bcefe45bb52fde7b1f5fc6c4d",
"target": {
"file": "drivers/net/wireless/realtek/rtw88/main.c",
"function": "rtw_wait_firmware_completion"
},
"id": "CVE-2024-47718-012f4b08"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 332.0,
"function_hash": "72944630957404735747883596325166755250"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ceaab3fb64d6a5426a3db8f87f3e5757964f2532",
"target": {
"file": "drivers/net/wireless/realtek/rtw88/main.c",
"function": "rtw_wait_firmware_completion"
},
"id": "CVE-2024-47718-071425a0"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 338.0,
"function_hash": "196667861365858665955307364238290292185"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b8178a2ae272256ea0dc4f940320a81003535e2",
"target": {
"file": "drivers/net/wireless/realtek/rtw88/main.c",
"function": "rtw_wait_firmware_completion"
},
"id": "CVE-2024-47718-0a9e76db"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"94982010669187314088375515948729000512",
"246685985348606002344553051710899306297",
"209972768354462552098615897719981931005",
"121011799127839724315028575999408356395",
"259685917247365490641528997928212026204",
"318053371549291180883867367604308203219",
"306962224796082473061159709069363423464",
"200713876913588556466502966398289641986",
"32926130522751812325468295230180381078",
"52764394025680827730400648269141303241",
"44610494863238578409645063806401356022",
"175610523346826988210675464617245893367",
"298176824356441214070682504711865561728",
"163453338493463777843037430742199497197",
"46916378211579936122405384483192386912"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0c1e2da652cf70825739bc12d49ea15805690bf",
"target": {
"file": "drivers/net/wireless/realtek/rtw88/main.c"
},
"id": "CVE-2024-47718-0b9e0156"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"7267067328745849294174193810611174929",
"145640459210158259781548703905843794716",
"75976882431289306641873008608621152383",
"121011799127839724315028575999408356395",
"259685917247365490641528997928212026204",
"318053371549291180883867367604308203219",
"306962224796082473061159709069363423464",
"200713876913588556466502966398289641986",
"32926130522751812325468295230180381078",
"52764394025680827730400648269141303241",
"44610494863238578409645063806401356022",
"175610523346826988210675464617245893367",
"298176824356441214070682504711865561728",
"141971521316081135334685629508528886951",
"236688887977534002214688835398596806761"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e735a4c6137262bcefe45bb52fde7b1f5fc6c4d",
"target": {
"file": "drivers/net/wireless/realtek/rtw88/main.c"
},
"id": "CVE-2024-47718-0d4bb8f0"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"94982010669187314088375515948729000512",
"246685985348606002344553051710899306297",
"209972768354462552098615897719981931005",
"121011799127839724315028575999408356395",
"259685917247365490641528997928212026204",
"318053371549291180883867367604308203219",
"306962224796082473061159709069363423464",
"200713876913588556466502966398289641986",
"32926130522751812325468295230180381078",
"52764394025680827730400648269141303241",
"44610494863238578409645063806401356022",
"175610523346826988210675464617245893367",
"298176824356441214070682504711865561728",
"141971521316081135334685629508528886951",
"236688887977534002214688835398596806761"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ceaab3fb64d6a5426a3db8f87f3e5757964f2532",
"target": {
"file": "drivers/net/wireless/realtek/rtw88/main.c"
},
"id": "CVE-2024-47718-1be74ea9"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"7267067328745849294174193810611174929",
"145640459210158259781548703905843794716",
"75976882431289306641873008608621152383",
"121011799127839724315028575999408356395",
"259685917247365490641528997928212026204",
"318053371549291180883867367604308203219",
"306962224796082473061159709069363423464",
"200713876913588556466502966398289641986",
"32926130522751812325468295230180381078",
"52764394025680827730400648269141303241",
"44610494863238578409645063806401356022",
"175610523346826988210675464617245893367",
"298176824356441214070682504711865561728",
"141971521316081135334685629508528886951",
"236688887977534002214688835398596806761"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9432185540bafd42b7bfac6e6ef2f0a0fb4be447",
"target": {
"file": "drivers/net/wireless/realtek/rtw88/main.c"
},
"id": "CVE-2024-47718-309ad179"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"7267067328745849294174193810611174929",
"145640459210158259781548703905843794716",
"75976882431289306641873008608621152383",
"121011799127839724315028575999408356395",
"259685917247365490641528997928212026204",
"318053371549291180883867367604308203219",
"306962224796082473061159709069363423464",
"200713876913588556466502966398289641986",
"32926130522751812325468295230180381078",
"52764394025680827730400648269141303241",
"44610494863238578409645063806401356022",
"175610523346826988210675464617245893367",
"298176824356441214070682504711865561728",
"141971521316081135334685629508528886951",
"236688887977534002214688835398596806761"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7887ad11995a4142671cc49146db536f923c8568",
"target": {
"file": "drivers/net/wireless/realtek/rtw88/main.c"
},
"id": "CVE-2024-47718-41dea409"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"7267067328745849294174193810611174929",
"145640459210158259781548703905843794716",
"75976882431289306641873008608621152383",
"121011799127839724315028575999408356395",
"259685917247365490641528997928212026204",
"318053371549291180883867367604308203219",
"306962224796082473061159709069363423464",
"200713876913588556466502966398289641986",
"32926130522751812325468295230180381078",
"52764394025680827730400648269141303241",
"44610494863238578409645063806401356022",
"175610523346826988210675464617245893367",
"298176824356441214070682504711865561728",
"141971521316081135334685629508528886951",
"236688887977534002214688835398596806761"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9a78d9417e167410d6fb83c4e908b077ad8ba6d",
"target": {
"file": "drivers/net/wireless/realtek/rtw88/main.c"
},
"id": "CVE-2024-47718-43d5d8aa"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 338.0,
"function_hash": "196667861365858665955307364238290292185"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9a78d9417e167410d6fb83c4e908b077ad8ba6d",
"target": {
"file": "drivers/net/wireless/realtek/rtw88/main.c",
"function": "rtw_wait_firmware_completion"
},
"id": "CVE-2024-47718-88e6282a"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"7267067328745849294174193810611174929",
"145640459210158259781548703905843794716",
"75976882431289306641873008608621152383",
"121011799127839724315028575999408356395",
"259685917247365490641528997928212026204",
"318053371549291180883867367604308203219",
"306962224796082473061159709069363423464",
"200713876913588556466502966398289641986",
"32926130522751812325468295230180381078",
"52764394025680827730400648269141303241",
"44610494863238578409645063806401356022",
"175610523346826988210675464617245893367",
"298176824356441214070682504711865561728",
"141971521316081135334685629508528886951",
"236688887977534002214688835398596806761"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b8178a2ae272256ea0dc4f940320a81003535e2",
"target": {
"file": "drivers/net/wireless/realtek/rtw88/main.c"
},
"id": "CVE-2024-47718-a08c8571"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 332.0,
"function_hash": "72944630957404735747883596325166755250"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0c1e2da652cf70825739bc12d49ea15805690bf",
"target": {
"file": "drivers/net/wireless/realtek/rtw88/main.c",
"function": "rtw_wait_firmware_completion"
},
"id": "CVE-2024-47718-ba1744ef"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 338.0,
"function_hash": "196667861365858665955307364238290292185"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9432185540bafd42b7bfac6e6ef2f0a0fb4be447",
"target": {
"file": "drivers/net/wireless/realtek/rtw88/main.c",
"function": "rtw_wait_firmware_completion"
},
"id": "CVE-2024-47718-f528f777"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 338.0,
"function_hash": "196667861365858665955307364238290292185"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7887ad11995a4142671cc49146db536f923c8568",
"target": {
"file": "drivers/net/wireless/realtek/rtw88/main.c",
"function": "rtw_wait_firmware_completion"
},
"id": "CVE-2024-47718-faebce1a"
}
]