In the Linux kernel, the following vulnerability has been resolved:
mac80211: fix use-after-free in CCMP/GCMP RX
When PN checking is done in mac80211, for fragmentation we need to copy the PN to the RX struct so we can later use it to do a comparison, since commit bf30ca922a0c ("mac80211: check defrag PN against current frame").
Unfortunately, in that commit I used the 'hdr' variable without it being necessarily valid, so use-after-free could occur if it was necessary to reallocate (parts of) the frame.
Fix this by reloading the variable after the code that results in the reallocations, if any.
This fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade dlm-kmp-rtUpgrade kernel-debug-vdsoUpgrade reiserfs-kmp-64kbUpgrade cluster-md-kmp-64kbUpgrade dtb-appleUpgrade kselftests-kmp-rtUpgrade kernel-default-livepatchUpgrade kernel-develUpgrade kernel-rt-extraUpgrade kernel-source-rtUpgrade kernel-default-vdsoUpgrade dtb-nvidiaUpgrade kernel-defaultUpgrade dtb-socionextUpgrade dlm-kmp-defaultUpgrade kernel-rt-livepatchUpgrade dtb-rockchipUpgrade dtb-amdUpgrade kernel-azure-optionalUpgrade dtb-allwinnerUpgrade dtb-renesasUpgrade kernel-preempt-develUpgrade kernel-rt-vdsoUpgrade kernel-source-vanillaUpgrade kernel-docs-htmlUpgrade kernel-debug-develUpgrade dtb-sprdUpgrade dtb-marvellUpgrade kernel-rt_debug-develUpgrade ocfs2-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade gfs2-kmp-azureUpgrade kernel-azureUpgrade kernel-64kb-extraUpgrade kernel-obs-buildUpgrade dtb-alteraUpgrade kernel-docsUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-baseUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-optionalUpgrade dtb-xilinxUpgrade gfs2-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade kernel-rt-optionalUpgrade reiserfs-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade dtb-broadcomUpgrade cluster-md-kmp-rtUpgrade kselftests-kmp-azureUpgrade dtb-caviumUpgrade ocfs2-kmp-defaultUpgrade gfs2-kmp-64kbUpgrade dtb-lgUpgrade kernel-default-base-rebuildUpgrade cluster-md-kmp-defaultUpgrade kernel-devel-rtUpgrade kernel-64kb-livepatch-develUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rtUpgrade dtb-armUpgrade kernel-default-develUpgrade dtb-freescaleUpgrade kernel-rt_debug-vdsoUpgrade kernel-kvmsmall-develUpgrade kernel-rt-livepatch-develUpgrade kernel-azure-livepatch-develUpgrade kernel-64kb-develUpgrade kernel-azure-develUpgrade dtb-qcomUpgrade dtb-mediatekUpgrade kernel-azure-vdsoUpgrade kernel-kvmsmallUpgrade kselftests-kmp-64kbUpgrade kselftests-kmp-defaultUpgrade dtb-hisiliconUpgrade kernel-default-extraUpgrade dtb-exynosUpgrade kernel-64kbUpgrade dtb-apmUpgrade kernel-rt-develUpgrade gfs2-kmp-rtUpgrade kernel-syms-rtUpgrade ocfs2-kmp-rtUpgrade kernel-zfcpdumpUpgrade kernel-macrosUpgrade kernel-preemptUpgrade kernel-debug-livepatch-develUpgrade kernel-syms-azureUpgrade kernel-devel-azureUpgrade dtb-amazonUpgrade dlm-kmp-64kbUpgrade kernel-obs-qaUpgrade kernel-source-azureUpgrade kernel-azure-extraUpgrade cluster-md-kmp-azureUpgrade kernel-rt_debugUpgrade dtb-amlogicUpgrade kernel-64kb-optionalUpgrade dlm-kmp-azureUpgrade kernel-symsUpgrade kernel-debugUpgrade kernel-source | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-aws-5.4Upgrade linux-raspiUpgrade linux-aws-hweUpgrade linux-azureUpgrade linux-raspi-5.4Upgrade linux-awsUpgrade linux-oracle-5.4Upgrade linux-kvmUpgrade linux-bluefieldUpgrade linux-gcp-fipsUpgrade linux-aws-fipsUpgrade linux-ibmUpgrade linux-gkeopUpgrade linux-hweUpgrade linux-oracleUpgrade linux-azure-fipsUpgrade linux-hwe-5.4Upgrade linux-azure-5.4Upgrade linux-azure-4.15Upgrade linux-gcpUpgrade linuxUpgrade linux-fipsUpgrade linux-gcp-4.15Upgrade linux-gcp-5.4 | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub