In the Linux kernel, the following vulnerability has been resolved:
mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap
Limit max values for vht mcs and nss in ieee80211_parse_tx_radiotap routine in order to fix the following warning reported by syzbot:
WARNING: CPU: 0 PID: 10717 at include/net/mac80211.h:989 ieee80211_rate_set_vht include/net/mac80211.h:989 [inline] WARNING: CPU: 0 PID: 10717 at include/net/mac80211.h:989 ieee80211_parse_tx_radiotap+0x101e/0x12d0 net/mac80211/tx.c:2244 Modules linked in: CPU: 0 PID: 10717 Comm: syz-executor.5 Not tainted 5.14.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:ieee80211_rate_set_vht include/net/mac80211.h:989 [inline] RIP: 0010:ieee80211_parse_tx_radiotap+0x101e/0x12d0 net/mac80211/tx.c:2244 RSP: 0018:ffffc9000186f3e8 EFLAGS: 00010216 RAX: 0000000000000618 RBX: ffff88804ef76500 RCX: ffffc900143a5000 RDX: 0000000000040000 RSI: ffffffff888f478e RDI: 0000000000000003 RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000100 R10: ffffffff888f46f9 R11: 0000000000000000 R12: 00000000fffffff8 R13: ffff88804ef7653c R14: 0000000000000001 R15: 0000000000000004 FS: 00007fbf5718f700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2de23000 CR3: 000000006a671000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: ieee80211_monitor_select_queue+0xa6/0x250 net/mac80211/iface.c:740 netdev_core_pick_tx+0x169/0x2e0 net/core/dev.c:4089 __dev_queue_xmit+0x6f9/0x3710 net/core/dev.c:4165 __bpf_tx_skb net/core/filter.c:2114 [inline] __bpf_redirect_no_mac net/core/filter.c:2139 [inline] __bpf_redirect+0x5ba/0xd20 net/core/filter.c:2162 ____bpf_clone_redirect net/core/filter.c:2429 [inline] bpf_clone_redirect+0x2ae/0x420 net/core/filter.c:2401 bpf_prog_eeb6f53a69e5c6a2+0x59/0x234 bpf_dispatcher_nop_func include/linux/bpf.h:717 [inline] __bpf_prog_run include/linux/filter.h:624 [inline] bpf_prog_run include/linux/filter.h:631 [inline] bpf_test_run+0x381/0xa30 net/bpf/test_run.c:119 bpf_prog_test_run_skb+0xb84/0x1ee0 net/bpf/test_run.c:663 bpf_prog_test_run kernel/bpf/syscall.c:3307 [inline] __sys_bpf+0x2137/0x5df0 kernel/bpf/syscall.c:4605 __do_sys_bpf kernel/bpf/syscall.c:4691 [inline] __se_sys_bpf kernel/bpf/syscall.c:4689 [inline] __x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:4689 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4665f9
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade python3-perfUpgrade kernel-tools-libs | Oct 8, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-tools | Oct 8, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-source-vanillaUpgrade kernel-debug-develUpgrade kernel-preempt-develUpgrade kernel-64kbUpgrade dtb-caviumUpgrade kernel-azure-extraUpgrade kernel-default-livepatchUpgrade kernel-default-vdsoUpgrade ocfs2-kmp-azureUpgrade cluster-md-kmp-azureUpgrade kernel-rt-extraUpgrade kernel-source-rtUpgrade kernel-source-azureUpgrade dtb-alteraUpgrade dlm-kmp-64kbUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmall-vdsoUpgrade dtb-renesasUpgrade kernel-obs-buildUpgrade dtb-freescaleUpgrade dtb-amazonUpgrade dtb-amdUpgrade kernel-devel-azureUpgrade kernel-64kb-extraUpgrade kernel-64kb-optionalUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-sourceUpgrade kernel-docs-htmlUpgrade kernel-rt_debugUpgrade gfs2-kmp-defaultUpgrade dtb-broadcomUpgrade dtb-exynosUpgrade dtb-allwinnerUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-azureUpgrade kernel-default-develUpgrade kernel-rt-vdsoUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-sprdUpgrade ocfs2-kmp-defaultUpgrade gfs2-kmp-azureUpgrade kernel-debug-vdsoUpgrade dtb-appleUpgrade kernel-rt-optionalUpgrade cluster-md-kmp-64kbUpgrade ocfs2-kmp-64kbUpgrade kernel-rt_debug-develUpgrade kernel-azureUpgrade kernel-azure-develUpgrade kernel-azure-optionalUpgrade dtb-lgUpgrade dtb-marvellUpgrade kernel-syms-azureUpgrade kselftests-kmp-64kbUpgrade dtb-hisiliconUpgrade kernel-default-base-rebuildUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade dlm-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-rt-develUpgrade kernel-symsUpgrade cluster-md-kmp-defaultUpgrade kernel-azure-livepatch-develUpgrade kernel-default-optionalUpgrade kselftests-kmp-rtUpgrade kernel-default-extraUpgrade kernel-devel-rtUpgrade reiserfs-kmp-azureUpgrade kernel-64kb-develUpgrade ocfs2-kmp-rtUpgrade dlm-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade kernel-macrosUpgrade kernel-rtUpgrade dtb-qcomUpgrade kernel-debugUpgrade kernel-64kb-livepatch-develUpgrade kernel-docsUpgrade dtb-nvidiaUpgrade reiserfs-kmp-rtUpgrade kernel-obs-qaUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-livepatchUpgrade gfs2-kmp-rtUpgrade dtb-xilinxUpgrade dtb-mediatekUpgrade kernel-preemptUpgrade dtb-apmUpgrade kernel-default-baseUpgrade dtb-socionextUpgrade dtb-amlogicUpgrade kernel-kvmsmallUpgrade kernel-rt-livepatch-develUpgrade kernel-develUpgrade kernel-azure-vdsoUpgrade dtb-armUpgrade kernel-defaultUpgrade dtb-rockchipUpgrade kernel-debug-livepatch-develUpgrade dlm-kmp-rtUpgrade gfs2-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade kernel-syms-rt | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-oracle-5.4Upgrade linux-aws-hweUpgrade linux-azure-fipsUpgrade linux-kvmUpgrade linux-gkeopUpgrade linux-fipsUpgrade linux-raspiUpgrade linux-aws-5.4Upgrade linux-oracleUpgrade linux-gcp-fipsUpgrade linux-aws-fipsUpgrade linux-gcp-4.15Upgrade linux-hwe-5.4Upgrade linux-azure-5.4Upgrade linux-gcp-5.4Upgrade linux-ibmUpgrade linux-hweUpgrade linux-bluefieldUpgrade linux-raspi-5.4Upgrade linuxUpgrade linux-azure-4.15Upgrade linux-awsUpgrade linux-azureUpgrade linux-gcp | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub