Kalle Valo

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.4.89 **Description** A kernel panic issue has been resolved in the Linux kernel. The problem occurred during the unload and load of ath11k modules, causing a kernel panic due to an internal error. The issue was related to the `napi by id` function and the `netif napi add` function. The error was triggered when the `ath11k ahb config irq` function was called, leading to a crash. The issue was identified on a Generic DT based system with a CPU PID of 4435. **Recommendations** For Linux kernel version 5.4.89 and earlier, update to a newer version to resolve the issue. As a temporary workaround, consider disabling the `ath11k ahb config irq` function until a patch is available. Restrict access to the `ath11k ahb` module to minimize the risk of exploitation. Avoid using the `napi by id` function in the affected API endpoint until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: The issue is related to an array out-of-bounds access in the SoC stats of the ath12k wifi driver. The `ath12k soc dp stats::hal reo error` array is defined with a maximum size of `DP REO DST RING MAX`. However, the `ath12k dp rx process()` function accesses this array using the REO destination SRNG ring ID, which is incorrect. This leads to out-of-bounds array access. The fix involves modifying the `ath12k dp rx process()` function to use the normal ring ID directly instead of the SRNG ring ID. Recommendations: To resolve the issue, update the Linux kernel to version 6.6.58 or later. As a temporary workaround, consider modifying the `ath12k dp rx process()` function to use the normal ring ID directly instead of the SRNG ring ID to avoid out-of-bounds array access. Restrict access to the vulnerable `ath12k soc dp stats::hal reo error` array to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the wifi: ath11k: fix dfs radar event locking in the Linux kernel. The ath11k active pdevs are protected by RCU, but the DFS radar event handling code calling `ath11k mac get ar by pdev id()` was not marked as a read-side critical section. This could lead to potential use-after-free issues. The code in question has been marked as an RCU read-side critical section to avoid these issues. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.0.11 **Description** An issue in the Linux kernel's WILC1000 wireless driver is related to a heap-based buffer overflow. This occurs due to missing validation of the number of channels when copying the list of operating channels from Wi-Fi management frames. The exploitation of this issue can allow an attacker to execute arbitrary code or cause a denial of service. **Recommendations** For Linux kernel versions prior to 6.0.11, update to version 6.0.11 or later to resolve the issue. As a temporary workaround, consider disabling the WILC1000 wireless driver until a patch is available. Restrict access to the `cfg80211.c` module in the WILC1000 driver to minimize the risk of exploitation. Avoid using the vulnerable function related to channel validation in the affected driver until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.0.11 **Description** The issue is related to the WILC1000 wireless driver in the Linux kernel, where missing validation of `IEEE80211 P2P ATTR CHANNEL LIST` in `drivers/net/wireless/microchip/wilc1000/cfg80211.c` can trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames. This can potentially allow an attacker to execute arbitrary code or cause a denial of service. **Recommendations** For Linux kernel versions prior to 6.0.11, update to version 6.0.11 or later to resolve the issue. As a temporary workaround, consider disabling the WILC1000 wireless driver until a patch is available. Restrict access to the vulnerable `cfg80211.c` module to minimize the risk of exploitation. Avoid using the `IEEE80211 P2P ATTR CHANNEL LIST` attribute in the affected API endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.0.11 **Description** The issue is related to the WILC1000 wireless driver in the Linux kernel, specifically with the missing validation of `IEEE80211 P2P ATTR OPER CHANNEL` in the `cfg80211.c` file. This can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames, potentially allowing an attacker to execute arbitrary code or cause a denial of service. **Recommendations** For Linux kernel versions prior to 6.0.11, update to version 6.0.11 or later to resolve the issue. As a temporary workaround, consider disabling the WILC1000 wireless driver until a patch is available. Restrict access to the vulnerable `cfg80211.c` file to minimize the risk of exploitation. Avoid using the `IEEE80211 P2P ATTR OPER CHANNEL` attribute in the affected API endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.0.11 **Description** An issue in the Linux kernel's WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet, potentially allowing an attacker to cause a denial of service or elevate privileges. **Recommendations** For Linux kernel versions prior to 6.0.11, update to version 6.0.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the `hif.c` file in the `drivers/net/wireless/microchip/wilc1000` directory to minimize the risk of exploitation. Avoid using the `RSN` information element in Netlink packets until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A crash occurs in the ath11k driver during the removal of the `ath11k pci` module when the `amss.bin` file is missing. This is caused by the use of the `mhi async power up()` function, which fails to check for errors. The issue manifests as a null-pointer dereference and a general protection fault within the `ath11k hal srng access begin()` function. **Recommendations** Replace the call to `mhi async power up()` with `mhi sync power up()` within the `ath11k mhi start()` function to ensure errors are properly handled.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.10.120 Linux kernel versions prior to 5.15.45 Linux kernel versions prior to 5.17.13 Linux kernel versions prior to 5.18.2 **Description** A NULL pointer dereference exists in the `ath11k spectral scan config()` function within the `drivers/net/wireless/ath/ath11k/spectral.c` module of the Linux kernel. This issue occurs when `ath11k` modules are removed using `rmmod` while spectral scan is enabled, leading to a system crash and potential denial of service. The crash is triggered in the `ath11k spectral process data()` function during the spectral deinitialization process. **Recommendations** Update the Linux kernel to version 5.10.120 or later. Update the Linux kernel to version 5.15.45 or later. Update the Linux kernel to version 5.17.13 or later. Update the Linux kernel to version 5.18.2 or later.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A buffer overflow issue exists in the Linux kernel, specifically in the ath11k driver. The scan req params structure can hold a maximum of 10 SSIDs, but the driver reports a capacity of 16 SSIDs, leading to a potential buffer overflow when copying SSIDs into the structure. This issue can be triggered from wpa supplicant in userspace. The firmware supports up to 64 probe requests, with 16 SSIDs and 4 BSSIDs each. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a possible array out of bound access in the `mt7921 mcu tx rate report` function. This could potentially lead to security issues. The problem has been resolved by fixing the array out of bound issue and removing an unnecessary variable in the `mt7921 mcu tx rate report` function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.