CVE-2024-56539

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-56539
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() Replace one-element array with a flexible-array member in `struct mwifiex_ie_types_wildcard_ssid_params` to fix the following warning on a MT8173 Chromebook (mt8173-elm-hana): [ 356.775250] ------------[ cut here ]------------ [ 356.784543] memcpy: detected field-spanning write (size 6) of single field "wildcard_ssid_tlv->ssid" at drivers/net/wireless/marvell/mwifiex/scan.c:904 (size 1) [ 356.813403] WARNING: CPU: 3 PID: 742 at drivers/net/wireless/marvell/mwifiex/scan.c:904 mwifiex_scan_networks+0x4fc/0xf28 [mwifiex] The "(size 6)" above is exactly the length of the SSID of the network this device was connected to. The source of the warning looks like: ssid_len = user_scan_in->ssid_list[i].ssid_len; [...] memcpy(wildcard_ssid_tlv->ssid, user_scan_in->ssid_list[i].ssid, ssid_len); There is a #define WILDCARD_SSID_TLV_MAX_SIZE that uses sizeof() on this struct, but it already didn't account for the size of the one-element array, so it doesn't need to be changed.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1de0ca1d7320a645ba2ee5954f64be08935b002a Patch
https://git.kernel.org/stable/c/581261b2d6fdb4237b24fa13f5a5f87bf2861f2c Patch
https://git.kernel.org/stable/c/5fa329c44e1e635da2541eab28b6cdb8464fc8d1 Patch
https://git.kernel.org/stable/c/a09760c513ae0f98c7082a1deace7fb6284ee866 Patch
https://git.kernel.org/stable/c/b466746cfb6be43f9a1457bbee52ade397fb23ea Patch
https://git.kernel.org/stable/c/c4698ef8c42e02782604bf4f8a489dbf6b0c1365 Patch
https://git.kernel.org/stable/c/d241a139c2e9f8a479f25c75ebd5391e6a448500 Patch
https://git.kernel.org/stable/c/d7774910c5583e61c5fe2571280366624ef48036 Patch
https://git.kernel.org/stable/c/e2de22e4b6213371d9e76f74a10ce817572a8d74 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

08 Oct 2025, 13:49

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE NVD-CWE-noinfo
References () https://git.kernel.org/stable/c/1de0ca1d7320a645ba2ee5954f64be08935b002a - () https://git.kernel.org/stable/c/1de0ca1d7320a645ba2ee5954f64be08935b002a - Patch
References () https://git.kernel.org/stable/c/581261b2d6fdb4237b24fa13f5a5f87bf2861f2c - () https://git.kernel.org/stable/c/581261b2d6fdb4237b24fa13f5a5f87bf2861f2c - Patch
References () https://git.kernel.org/stable/c/5fa329c44e1e635da2541eab28b6cdb8464fc8d1 - () https://git.kernel.org/stable/c/5fa329c44e1e635da2541eab28b6cdb8464fc8d1 - Patch
References () https://git.kernel.org/stable/c/a09760c513ae0f98c7082a1deace7fb6284ee866 - () https://git.kernel.org/stable/c/a09760c513ae0f98c7082a1deace7fb6284ee866 - Patch
References () https://git.kernel.org/stable/c/b466746cfb6be43f9a1457bbee52ade397fb23ea - () https://git.kernel.org/stable/c/b466746cfb6be43f9a1457bbee52ade397fb23ea - Patch
References () https://git.kernel.org/stable/c/c4698ef8c42e02782604bf4f8a489dbf6b0c1365 - () https://git.kernel.org/stable/c/c4698ef8c42e02782604bf4f8a489dbf6b0c1365 - Patch
References () https://git.kernel.org/stable/c/d241a139c2e9f8a479f25c75ebd5391e6a448500 - () https://git.kernel.org/stable/c/d241a139c2e9f8a479f25c75ebd5391e6a448500 - Patch
References () https://git.kernel.org/stable/c/d7774910c5583e61c5fe2571280366624ef48036 - () https://git.kernel.org/stable/c/d7774910c5583e61c5fe2571280366624ef48036 - Patch
References () https://git.kernel.org/stable/c/e2de22e4b6213371d9e76f74a10ce817572a8d74 - () https://git.kernel.org/stable/c/e2de22e4b6213371d9e76f74a10ce817572a8d74 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux
Linux linux Kernel
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mwifiex: Se corrige la advertencia de escritura que abarca el campo memcpy() en mwifiex_config_scan() Reemplace la matriz de un elemento con un miembro de matriz flexible en `struct mwifiex_ie_types_wildcard_ssid_params` para corregir la siguiente advertencia en una Chromebook MT8173 (mt8173-elm-hana): [ 356.775250] ------------[ cortar aquí ]------------ [ 356.784543] memcpy: se detectó escritura que abarca el campo (tamaño 6) del campo único "wildcard_ssid_tlv->ssid" en drivers/net/wireless/marvell/mwifiex/scan.c:904 (tamaño 1) [ 356.813403] ADVERTENCIA: CPU: 3 PID: 742 en drivers/net/wireless/marvell/mwifiex/scan.c:904 mwifiex_scan_networks+0x4fc/0xf28 [mwifiex] El "(tamaño 6)" anterior es exactamente la longitud del SSID de la red a la que estaba conectado este dispositivo. La fuente de la advertencia se ve así: ssid_len = user_scan_in->ssid_list[i].ssid_len; [...] memcpy(wildcard_ssid_tlv->ssid, user_scan_in->ssid_list[i].ssid, ssid_len); Hay un #define WILDCARD_SSID_TLV_MAX_SIZE que usa sizeof() en esta estructura, pero ya no tenía en cuenta el tamaño de la matriz de un elemento, por lo que no es necesario cambiarlo.

27 Dec 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-27 14:15

Updated : 2025-10-08 13:49

NVD link : CVE-2024-56539

Mitre link : CVE-2024-56539

CVE.ORG link : CVE-2024-56539

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo