In the Linux kernel, the following vulnerability has been resolved:
mac80211: fix use-after-free in CCMP/GCMP RX
When PN checking is done in mac80211, for fragmentation we need to copy the PN to the RX struct so we can later use it to do a comparison, since commit bf30ca922a0c ("mac80211: check defrag PN against current frame").
Unfortunately, in that commit I used the 'hdr' variable without it being necessarily valid, so use-after-free could occur if it was necessary to reallocate (parts of) the frame.
Fix this by reloading the variable after the code that results in the reallocations, if any.
This fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade dlm-kmp-64kbUpgrade kernel-obs-qaUpgrade kernel-devel-azureUpgrade kernel-debugUpgrade cluster-md-kmp-defaultUpgrade kernel-kvmsmall-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-vdsoUpgrade kselftests-kmp-64kbUpgrade kernel-azure-develUpgrade kernel-64kb-develUpgrade kernel-azure-livepatch-develUpgrade dtb-mediatekUpgrade kernel-64kbUpgrade kernel-64kb-optionalUpgrade kernel-syms-azureUpgrade kernel-zfcpdumpUpgrade kernel-default-develUpgrade kernel-syms-rtUpgrade dtb-qcomUpgrade kernel-kvmsmallUpgrade kernel-devel-rtUpgrade dtb-armUpgrade kernel-azure-extraUpgrade kernel-64kb-livepatch-develUpgrade dtb-freescaleUpgrade kernel-default-base-rebuildUpgrade cluster-md-kmp-azureUpgrade dtb-hisiliconUpgrade dtb-apmUpgrade kernel-default-extraUpgrade kselftests-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade gfs2-kmp-64kbUpgrade kernel-symsUpgrade dtb-lgUpgrade kernel-sourceUpgrade kernel-preemptUpgrade kernel-macrosUpgrade kernel-source-azureUpgrade kernel-rtUpgrade dtb-amazonUpgrade kernel-rt-develUpgrade kernel-rt_debugUpgrade kernel-debug-livepatch-develUpgrade dtb-amlogicUpgrade gfs2-kmp-rtUpgrade ocfs2-kmp-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade dlm-kmp-azureUpgrade dtb-exynosUpgrade kernel-source-rtUpgrade kernel-defaultUpgrade kernel-docsUpgrade kernel-azure-optionalUpgrade dtb-appleUpgrade kernel-default-livepatchUpgrade kselftests-kmp-rtUpgrade kernel-develUpgrade reiserfs-kmp-defaultUpgrade dtb-sprdUpgrade gfs2-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-preempt-develUpgrade kernel-default-baseUpgrade ocfs2-kmp-64kbUpgrade kernel-azureUpgrade dtb-alteraUpgrade dtb-renesasUpgrade reiserfs-kmp-rtUpgrade kernel-source-vanillaUpgrade dtb-allwinnerUpgrade dlm-kmp-defaultUpgrade dtb-xilinxUpgrade kernel-rt_debug-develUpgrade kernel-obs-buildUpgrade kernel-rt_debug-livepatch-develUpgrade reiserfs-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-debug-develUpgrade dtb-broadcomUpgrade kernel-default-optionalUpgrade dtb-caviumUpgrade kernel-rt-optionalUpgrade kernel-default-livepatch-develUpgrade dtb-marvellUpgrade gfs2-kmp-azureUpgrade cluster-md-kmp-rtUpgrade kernel-64kb-extraUpgrade kselftests-kmp-azureUpgrade kernel-kvmsmall-vdsoUpgrade dtb-amdUpgrade kernel-docs-htmlUpgrade dlm-kmp-rtUpgrade dtb-nvidiaUpgrade kernel-rt-extraUpgrade kernel-rt-livepatchUpgrade reiserfs-kmp-64kbUpgrade kernel-debug-vdsoUpgrade kernel-default-vdsoUpgrade dtb-rockchipUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-vdsoUpgrade dtb-socionext | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linuxUpgrade linux-oracleUpgrade linux-hwe-5.4Upgrade linux-gcp-fipsUpgrade linux-ibmUpgrade linux-fipsUpgrade linux-aws-fipsUpgrade linux-azure-4.15Upgrade linux-azure-fipsUpgrade linux-hweUpgrade linux-gkeopUpgrade linux-gcp-5.4Upgrade linux-azure-5.4Upgrade linux-gcpUpgrade linux-gcp-4.15Upgrade linux-oracle-5.4Upgrade linux-awsUpgrade linux-aws-5.4Upgrade linux-kvmUpgrade linux-aws-hweUpgrade linux-raspi-5.4Upgrade linux-bluefieldUpgrade linux-raspiUpgrade linux-azure | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub