In the Linux kernel, the following vulnerability has been resolved:
mac80211: fix use-after-free in CCMP/GCMP RX
When PN checking is done in mac80211, for fragmentation we need to copy the PN to the RX struct so we can later use it to do a comparison, since commit bf30ca922a0c ("mac80211: check defrag PN against current frame").
Unfortunately, in that commit I used the 'hdr' variable without it being necessarily valid, so use-after-free could occur if it was necessary to reallocate (parts of) the frame.
Fix this by reloading the variable after the code that results in the reallocations, if any.
This fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade cluster-md-kmp-azureUpgrade dtb-freescaleUpgrade ocfs2-kmp-rtUpgrade kernel-macrosUpgrade dtb-armUpgrade dtb-exynosUpgrade kernel-kvmsmall-livepatch-develUpgrade kselftests-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmall-develUpgrade kernel-syms-azureUpgrade dtb-hisiliconUpgrade kernel-syms-rtUpgrade kernel-64kb-develUpgrade kernel-rt-develUpgrade kernel-debugUpgrade kernel-sourceUpgrade kernel-default-develUpgrade kernel-64kb-livepatch-develUpgrade kernel-64kbUpgrade cluster-md-kmp-defaultUpgrade dtb-apmUpgrade kernel-debug-livepatch-develUpgrade kernel-devel-rtUpgrade kernel-rtUpgrade kernel-obs-qaUpgrade kernel-rt_debugUpgrade kernel-azure-extraUpgrade kernel-devel-azureUpgrade dtb-qcomUpgrade dlm-kmp-azureUpgrade kernel-symsUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-rtUpgrade kernel-64kb-optionalUpgrade gfs2-kmp-64kbUpgrade dtb-lgUpgrade kernel-default-base-rebuildUpgrade dtb-amlogicUpgrade dtb-amazonUpgrade kernel-azure-livepatch-develUpgrade kernel-default-extraUpgrade dtb-mediatekUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-develUpgrade kernel-source-azureUpgrade kernel-preemptUpgrade kernel-azure-vdsoUpgrade kselftests-kmp-defaultUpgrade dlm-kmp-64kbUpgrade kernel-kvmsmallUpgrade kselftests-kmp-rtUpgrade reiserfs-kmp-rtUpgrade dtb-caviumUpgrade dtb-broadcomUpgrade kernel-azureUpgrade dtb-renesasUpgrade kernel-defaultUpgrade dtb-sprdUpgrade reiserfs-kmp-defaultUpgrade dtb-alteraUpgrade dtb-xilinxUpgrade dtb-socionextUpgrade kernel-rt-vdsoUpgrade kernel-default-optionalUpgrade kernel-default-baseUpgrade dtb-amdUpgrade dtb-appleUpgrade kernel-azure-optionalUpgrade kernel-source-rtUpgrade gfs2-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade reiserfs-kmp-azureUpgrade kernel-default-livepatchUpgrade kernel-rt_debug-develUpgrade ocfs2-kmp-defaultUpgrade kernel-docs-htmlUpgrade reiserfs-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade cluster-md-kmp-rtUpgrade kernel-rt-optionalUpgrade kernel-docsUpgrade kernel-debug-vdsoUpgrade kernel-default-vdsoUpgrade kernel-64kb-extraUpgrade dtb-rockchipUpgrade dtb-allwinnerUpgrade gfs2-kmp-azureUpgrade dtb-marvellUpgrade dlm-kmp-defaultUpgrade kernel-rt-extraUpgrade kernel-preempt-develUpgrade cluster-md-kmp-64kbUpgrade dlm-kmp-rtUpgrade dtb-nvidiaUpgrade kselftests-kmp-azureUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt-livepatchUpgrade kernel-obs-buildUpgrade kernel-debug-develUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-source-vanillaUpgrade ocfs2-kmp-64kbUpgrade kernel-devel | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-gcpUpgrade linux-azure-5.4Upgrade linux-fipsUpgrade linux-oracleUpgrade linux-azure-4.15Upgrade linux-aws-fipsUpgrade linuxUpgrade linux-hwe-5.4Upgrade linux-gcp-5.4Upgrade linux-gcp-fipsUpgrade linux-gkeopUpgrade linux-hweUpgrade linux-ibmUpgrade linux-azure-fipsUpgrade linux-gcp-4.15Upgrade linux-bluefieldUpgrade linux-raspiUpgrade linux-awsUpgrade linux-azureUpgrade linux-oracle-5.4Upgrade linux-kvmUpgrade linux-aws-5.4Upgrade linux-aws-hweUpgrade linux-raspi-5.4 | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub