{ "dataType": "CVE_RECORD", "cveMetadata": { "cveId": "CVE-2024-26610", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.130Z", "datePublished": "2024-02-29T15:52:15.796Z", "dateUpdated": "2026-08-05T11:26:14.007Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:26:14.007Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: fix a memory corruption\n\niwl_fw_ini_trigger_tlv::data is a pointer to a __le32, which means that\nif we copy to iwl_fw_ini_trigger_tlv::data + offset while offset is in\nbytes, we'll write past the buffer." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The overflowing data comes from debug TLVs parsed out of local files (`iwlwifi-*.ucode` and `iwl-debug-yoyo.bin` in /lib/firmware) during driver/firmware initialization, not from received 802.11 frames or any network input. Reaching the vulnerable merge requires local presence on the system (module/firmware load or the debugfs time-point/clear handlers), so this is Local rather than Adjacent.\nAC:L - The out-of-bounds write is fully deterministic — whenever two triggers share a time point and the newer one lacks IWL_FW_INI_APPLY_POLICY_OVERRIDE_DATA with non-empty existing data, the byte offset is unconditionally multiplied by four. There is no race, no memory-layout precondition, and INI debug is enabled by default, so no unusual configuration is needed.\nPR:L - Triggering requires only local access to the code path that (re)initializes the iwlwifi firmware debug configuration, with no authentication step in the path itself and no capability check inside iwl_dbg_tlv_override_trig_node. Between low and high privileges this is scored as the higher-severity Low, consistent with other locally-triggered iwlwifi memory-corruption CVEs.\nUI:N - No victim action is required — the trigger list is merged automatically at IWL_FW_INI_TIME_POINT_EARLY during normal firmware load, which occurs at boot or whenever the device is brought up.\nS:U - The overflow corrupts kernel slab memory and its impact is confined to the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The heap overflow writes past the krealloc'd node into adjacent slab objects, corrupting neighbouring kernel structures such as pointers and length fields, which can be leveraged into an arbitrary kernel read primitive and disclosure of arbitrary memory.\nI:H - This is an out-of-bounds heap write of attacker-influenced content whose length (roughly 3 x data_len) and payload both come from the trigger TLV, giving a shaped write into adjacent slab objects — the standard primitive for kernel data/control-flow corruption and privilege escalation.\nA:H - Slab corruption of adjacent objects reliably produces kernel oopses, allocator BUG_ON/hardened-usercopy panics, or later crashes on freeing the smashed neighbours, resulting in a complete denial of service." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c" ], "versions": [ { "version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "lessThan": "05dd9facfb9a1e056752c0901c6e86416037d15a", "status": "affected", "versionType": "git" }, { "version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "lessThan": "99a23462fe1a6f709f0fda3ebbe8b6b193ac75bd", "status": "affected", "versionType": "git" }, { "version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "lessThan": "aa2cc9363926991ba74411e3aa0a0ea82c1ffe32", "status": "affected", "versionType": "git" }, { "version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "lessThan": "870171899d75d43e3d14360f3a4850e90a9c289b", "status": "affected", "versionType": "git" }, { "version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "lessThan": "f32a81999d0b8e5ce60afb5f6a3dd7241c17dd67", "status": "affected", "versionType": "git" }, { "version": "cf29c5b66b9f83939367d90679eb68cdfa2f0356", "lessThan": "cf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4d", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c" ], "versions": [ { "version": "5.5", "status": "affected" }, { "version": "0", "lessThan": "5.5", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.210", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.149", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.76", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.15", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.7.3", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.10.210" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.15.149" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.1.76" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.6.15" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.7.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.8" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/05dd9facfb9a1e056752c0901c6e86416037d15a" }, { "url": "https://git.kernel.org/stable/c/99a23462fe1a6f709f0fda3ebbe8b6b193ac75bd" }, { "url": "https://git.kernel.org/stable/c/aa2cc9363926991ba74411e3aa0a0ea82c1ffe32" }, { "url": "https://git.kernel.org/stable/c/870171899d75d43e3d14360f3a4850e90a9c289b" }, { "url": "https://git.kernel.org/stable/c/f32a81999d0b8e5ce60afb5f6a3dd7241c17dd67" }, { "url": "https://git.kernel.org/stable/c/cf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4d" } ], "title": "wifi: iwlwifi: fix a memory corruption", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-26610", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-03-12T18:22:31.931608Z" } } } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:49:28.637Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:07:19.572Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/05dd9facfb9a1e056752c0901c6e86416037d15a", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/99a23462fe1a6f709f0fda3ebbe8b6b193ac75bd", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/aa2cc9363926991ba74411e3aa0a0ea82c1ffe32", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/870171899d75d43e3d14360f3a4850e90a9c289b", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/f32a81999d0b8e5ce60afb5f6a3dd7241c17dd67", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/cf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4d", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": [ "x_transferred" ] } ] } ] }, "dataVersion": "5.2" }