CVE-2024-38562

HIGH

Linux Kernel 6.6-6.6.32, 6.7-6.8.11, 6.9-6.9.2 - Out-of-Bounds Array Indexing in WiFi nl80211 Channel Request Handler

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: Avoid address calculations via out of bounds array indexing Before request->channels[] can be used, request->n_channels must be set. Additionally, address calculations for memory after the "channels" array need to be calculated from the allocation base ("request") rather than via the first "out of bounds" index of "channels", otherwise run-time bounds checking will throw a warning.

Scores

CVSS v3 7.8
EPSS 0.0023
EPSS Percentile 14.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-129
Status published
Products (14)
linux/Kernel 6.6.0 - 6.6.33linux
linux/Kernel 6.7.0 - 6.8.12linux
linux/Kernel 6.9.0 - 6.9.3linux
Linux/Linux < 6.6
Linux/Linux 6.10
Linux/Linux 6.6
Linux/Linux 6.6.33 - 6.6.*
Linux/Linux 6.8.12 - 6.8.*
Linux/Linux 6.9.3 - 6.9.*
Linux/Linux e3eac9f32ec04112b39e01b574ac739382469bf9 - 4e2a5566462b53db7d4c4722da86eedf0b8f546c
... and 4 more
Published Jun 19, 2024
Tracked Since Feb 18, 2026