cve/2024/CVE-2024-49930.md

CVE-2024-49930

Description

In the Linux kernel, the following vulnerability has been resolved:wifi: ath11k: fix array out-of-bound access in SoC statsCurrently, the ath11k_soc_dp_stats::hal_reo_error array is defined with amaximum size of DP_REO_DST_RING_MAX. However, the ath11k_dp_process_rx()function access ath11k_soc_dp_stats::hal_reo_error using the REOdestination SRNG ring ID, which is incorrect. SRNG ring ID differ fromnormal ring ID, and this usage leads to out-of-bounds array access. To fixthis issue, modify ath11k_dp_process_rx() to use the normal ring IDdirectly instead of the SRNG ring ID to avoid out-of-bounds array access.Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1

POC

Reference

No PoCs from references.

Github

• https://github.com/w4zu/Debian_security