CVE-2024-57995

Summary

CVE-2024-57995 is a vulnerability affecting the Linux kernel's wifi driver, specifically the ath12k driver. In the function ath12k_mac_assign_vif_to_vdev(), if a Virtual Interface (vif) is created on a different radio, it gets deleted from that radio, freeing the arvif pointer. Subsequently, there is a check involving arvif, leading to a read-after-free scenario. This issue has been resolved by moving the check after arvif is reassigned via a call to ath12k_mac_assign_link_vif(). This vulnerability was tested on the QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.