Miri Korenblit

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A NULL pointer dereference issue has been resolved in the Linux kernel. The issue occurs in the `iwl mvm tx skb sta()` and `iwl mvm tx mpdu()` functions, which verify that the `mvmvsta` pointer is not NULL. The pointer is retrieved using `iwl mvm sta from mac80211`, which dereferences the `ieee80211 sta` pointer. If the `sta` pointer is NULL, `iwl mvm sta from mac80211` will dereference a NULL pointer. The fix involves checking the `sta` pointer before retrieving the `mvmsta` from it. Recommendations: For Linux kernel versions prior to 6.6.58, update to version 6.6.58 or later to resolve the issue. As a temporary workaround, consider implementing checks to prevent NULL pointer dereferences in the affected functions. Restrict access to the vulnerable `iwl mvm tx skb sta()` and `iwl mvm tx mpdu()` functions to minimize the risk of exploitation. Avoid using the `sta` pointer in the affected code paths until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue arises in the Linux kernel's wifi component, specifically in the iwlwifi module, where the `n ssids` value is not properly checked before accessing the `ssids` pointer. This can lead to an out-of-bound access when `n ssids` is 0, even if the `ssids` pointer is valid. The problem is resolved by adding a check for `n ssids` before accessing the `ssids` pointer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the wifi: iwlwifi: read txq->read ptr under lock in the Linux kernel. If `txq->read ptr` is read without a lock, it can result in reading the same value twice, then obtaining the lock, and reclaiming from there to two different places, but crucially reclaiming the same entry twice, resulting in the WARN ONCE() a little later. The fix is to read `txq->read ptr` under lock. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.