CVE-2024-35913

CVE Details

Release Date:

2024-05-19

Description

In the Linux kernel, the following vulnerability has been resolved:\nwifi: iwlwifi: mvm: pick the version of SESSION_PROTECTION_NOTIF\nWhen we want to know whether we should look for the mac_id or the\nlink_id in struct iwl_mvm_session_prot_notif, we should look at the\nversion of SESSION_PROTECTION_NOTIF.\nThis causes WARNINGs:\nWARNING: CPU: 0 PID: 11403 at drivers/net/wireless/intel/iwlwifi/mvm/time-event.c:959 iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm]\nRIP: 0010:iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm]\nCode: 00 49 c7 84 24 48 07 00 00 00 00 00 00 41 c6 84 24 78 07 00 00 ff 4c 89 f7 e8 e9 71 54 d9 e9 7d fd ff ff 0f 0b e9 23 fe ff ff <0f> 0b e9 1c fe ff ff 66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90\nRSP: 0018:ffffb4bb00003d40 EFLAGS: 00010202\nRAX: 0000000000000000 RBX: ffff9ae63a361000 RCX: ffff9ae4a98b60d4\nRDX: ffff9ae4588499c0 RSI: 0000000000000305 RDI: ffff9ae4a98b6358\nRBP: ffffb4bb00003d68 R08: 0000000000000003 R09: 0000000000000010\nR10: ffffb4bb00003d00 R11: 000000000000000f R12: ffff9ae441399050\nR13: ffff9ae4761329e8 R14: 0000000000000001 R15: 0000000000000000\nFS: 0000000000000000(0000) GS:ffff9ae7af400000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000055fb75680018 CR3: 00000003dae32006 CR4: 0000000000f70ef0\nPKRU: 55555554\nCall Trace:\n\n? show_regs+0x69/0x80\n? __warn+0x8d/0x150\n? iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm]\n? report_bug+0x196/0x1c0\n? handle_bug+0x45/0x80\n? exc_invalid_op+0x1c/0xb0\n? asm_exc_invalid_op+0x1f/0x30\n? iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm]\niwl_mvm_rx_common+0x115/0x340 [iwlmvm]\niwl_mvm_rx_mq+0xa6/0x100 [iwlmvm]\niwl_pcie_rx_handle+0x263/0xa10 [iwlwifi]\niwl_pcie_napi_poll_msix+0x32/0xd0 [iwlwifi]

See more information about CVE-2024-35913 from MITRE CVE dictionary and NIST NVD

CVSS Scoring

NOTE: The following CVSS v3.1 metrics and score provided are preliminary and subject to review.

Base Score:	5.5	CVSS Vector:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector:	Local network	Attack Complexity:	Low
Privileges Required:	Low	User Interaction:	None
Scope:	Unchanged	Confidentiality Impact:	None
Integrity Impact:	None	Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 9 (kernel)	ELSA-2024-9315	2024-11-14