In the Linux kernel, the following vulnerability has been resolved:
mac80211: fix use-after-free in CCMP/GCMP RX
When PN checking is done in mac80211, for fragmentation we need to copy the PN to the RX struct so we can later use it to do a comparison, since commit bf30ca922a0c ("mac80211: check defrag PN against current frame").
Unfortunately, in that commit I used the 'hdr' variable without it being necessarily valid, so use-after-free could occur if it was necessary to reallocate (parts of) the frame.
Fix this by reloading the variable after the code that results in the reallocations, if any.
This fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade dtb-exynosUpgrade ocfs2-kmp-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-azure-livepatch-develUpgrade kselftests-kmp-64kbUpgrade kernel-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-obs-qaUpgrade kernel-default-develUpgrade dtb-armUpgrade kernel-azure-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-kvmsmallUpgrade dlm-kmp-64kbUpgrade kernel-debug-livepatch-develUpgrade kernel-symsUpgrade gfs2-kmp-rtUpgrade dtb-amlogicUpgrade dtb-qcomUpgrade kernel-kvmsmall-develUpgrade kernel-rt-develUpgrade dtb-mediatekUpgrade dtb-freescaleUpgrade dlm-kmp-azureUpgrade kernel-azure-extraUpgrade cluster-md-kmp-defaultUpgrade dtb-amazonUpgrade kernel-preemptUpgrade kselftests-kmp-defaultUpgrade kernel-debugUpgrade kernel-64kb-livepatch-develUpgrade kernel-devel-rtUpgrade kernel-devel-azureUpgrade kernel-64kbUpgrade kernel-azure-vdsoUpgrade dtb-lgUpgrade kernel-syms-azureUpgrade gfs2-kmp-64kbUpgrade kernel-default-base-rebuildUpgrade cluster-md-kmp-azureUpgrade kernel-syms-rtUpgrade kernel-macrosUpgrade kernel-source-azureUpgrade kernel-64kb-optionalUpgrade kernel-sourceUpgrade kernel-zfcpdumpUpgrade dtb-apmUpgrade dtb-hisiliconUpgrade kernel-rt_debugUpgrade kernel-64kb-develUpgrade kernel-default-extraUpgrade kernel-rt-optionalUpgrade cluster-md-kmp-rtUpgrade gfs2-kmp-defaultUpgrade dtb-sprdUpgrade kernel-docs-htmlUpgrade kernel-64kb-extraUpgrade dtb-marvellUpgrade gfs2-kmp-azureUpgrade kselftests-kmp-azureUpgrade dtb-broadcomUpgrade dtb-xilinxUpgrade kernel-default-optionalUpgrade kernel-source-vanillaUpgrade kernel-default-baseUpgrade kselftests-kmp-rtUpgrade kernel-develUpgrade dtb-appleUpgrade kernel-azure-optionalUpgrade kernel-source-rtUpgrade kernel-defaultUpgrade dtb-socionextUpgrade kernel-azureUpgrade dtb-amdUpgrade dtb-renesasUpgrade dtb-alteraUpgrade kernel-rt-vdsoUpgrade kernel-rt-extraUpgrade kernel-rt-livepatchUpgrade kernel-default-vdsoUpgrade reiserfs-kmp-64kbUpgrade dlm-kmp-rtUpgrade kernel-debug-vdsoUpgrade dtb-nvidiaUpgrade dtb-allwinnerUpgrade dtb-rockchipUpgrade cluster-md-kmp-64kbUpgrade dlm-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-obs-buildUpgrade kernel-debug-develUpgrade kernel-rt_debug-livepatch-develUpgrade reiserfs-kmp-rtUpgrade kernel-default-livepatchUpgrade ocfs2-kmp-64kbUpgrade reiserfs-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade dtb-caviumUpgrade kernel-docsUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt_debug-develUpgrade kernel-preempt-develUpgrade kernel-default-livepatch-devel | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-awsUpgrade linux-bluefieldUpgrade linux-azureUpgrade linux-raspiUpgrade linux-oracle-5.4Upgrade linux-aws-hweUpgrade linux-kvmUpgrade linux-aws-5.4Upgrade linux-raspi-5.4Upgrade linux-fipsUpgrade linux-azure-4.15Upgrade linux-aws-fipsUpgrade linux-azure-fipsUpgrade linux-azure-5.4Upgrade linux-gcp-4.15Upgrade linux-ibmUpgrade linux-gcp-fipsUpgrade linux-gcp-5.4Upgrade linux-hweUpgrade linux-gcpUpgrade linux-gkeopUpgrade linuxUpgrade linux-hwe-5.4Upgrade linux-oracle | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub