CVE-2024-27434 (GCVE-0-2024-27434)

Vulnerability from cvelistv5 – Published: 2024-05-17 12:08 – Updated: 2026-08-05 11:29
VLAI
Title
wifi: iwlwifi: mvm: don't set the MFP flag for the GTK
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't set the MFP flag for the GTK The firmware doesn't need the MFP flag for the GTK, it can even make the firmware crash. in case the AP is configured with: group cipher TKIP and MFPC. We would send the GTK with cipher = TKIP and MFP which is of course not possible.
Severity
7.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 5c75a208c2449c6ea24f07610cc052f6a352246c , < b4f1b0b3b91762edd19bf9d3b2e4c3a0740501f8 (git)
Affected: 5c75a208c2449c6ea24f07610cc052f6a352246c , < 40405cbb20eb6541c603e7b3d54ade0a7be9d715 (git)
Affected: 5c75a208c2449c6ea24f07610cc052f6a352246c , < 60f6d5fc84a9fd26528a24d8a267fc6a6698b628 (git)
Affected: 5c75a208c2449c6ea24f07610cc052f6a352246c , < e35f316bce9e5733c9826120c1838f4c447b2c4c (git)
Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.6.23 , ≤ 6.6.* (semver)
Unaffected: 6.7.11 , ≤ 6.7.* (semver)
Unaffected: 6.8.2 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27434",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-17T17:16:46.787202Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:46:52.503Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:34:52.476Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b4f1b0b3b91762edd19bf9d3b2e4c3a0740501f8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/40405cbb20eb6541c603e7b3d54ade0a7be9d715"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/60f6d5fc84a9fd26528a24d8a267fc6a6698b628"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e35f316bce9e5733c9826120c1838f4c447b2c4c"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/mvm/mld-key.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b4f1b0b3b91762edd19bf9d3b2e4c3a0740501f8",
              "status": "affected",
              "version": "5c75a208c2449c6ea24f07610cc052f6a352246c",
              "versionType": "git"
            },
            {
              "lessThan": "40405cbb20eb6541c603e7b3d54ade0a7be9d715",
              "status": "affected",
              "version": "5c75a208c2449c6ea24f07610cc052f6a352246c",
              "versionType": "git"
            },
            {
              "lessThan": "60f6d5fc84a9fd26528a24d8a267fc6a6698b628",
              "status": "affected",
              "version": "5c75a208c2449c6ea24f07610cc052f6a352246c",
              "versionType": "git"
            },
            {
              "lessThan": "e35f316bce9e5733c9826120c1838f4c447b2c4c",
              "status": "affected",
              "version": "5c75a208c2449c6ea24f07610cc052f6a352246c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/mvm/mld-key.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.23",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.11",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.2",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: don\u0027t set the MFP flag for the GTK\n\nThe firmware doesn\u0027t need the MFP flag for the GTK, it can even make the\nfirmware crash. in case the AP is configured with: group cipher TKIP and\nMFPC. We would send the GTK with cipher = TKIP and MFP which is of course\nnot possible."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The trigger is entirely controlled by the 802.11 peer (AP) via its advertised RSN group cipher and MFPC capability, consumed during association/4-way handshake by a Wi-Fi client. This requires the attacker to be within radio range on the same wireless segment, i.e. adjacent network.\nAC:L - An attacker operating an AP (including an evil twin on a network whose PSK is known or shared, such as caf\u00e9/office/guest Wi-Fi) fully controls the required configuration \u2014 group cipher TKIP with MFPC \u2014 and the crash follows deterministically on GTK installation, with no race or memory-layout dependency. The other precondition (PMF negotiated, so `sta-\u003emfp` is set) is the default on modern supplicants.\nPR:N - The attacker needs no account, capability, or any privilege on the victim system; they merely configure the AP the client associates with. No local access or kernel-side authorization is involved on the target.\nUI:N - wpa_supplicant/NetworkManager auto-reconnect to a known SSID after a deauth means the association and GTK installation happen with no user action. The vulnerable code runs as part of normal automated connection setup.\nS:U - The consequences are confined to the Wi-Fi device and the kernel driver managing it \u2014 the same security authority as the vulnerable component. No VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is an incorrect flag bit in a firmware command; there is no out-of-bounds read, uninitialized data disclosure, or leak of kernel memory to the attacker.\nI:L - The group key is installed in firmware with the wrong protection semantics \u2014 flagged as en/decrypting management frames when a non-iGTK group key must not be \u2014 so management-frame protection state for the GTK is incorrect, which any group member could attempt to abuse for forged \"protected\" broadcast management frames. This is bounded, not arbitrary, modification.\nA:H - The malformed TKIP+MFP key command asserts the firmware, producing a SW-error dump and a full NIC restart with loss of wireless connectivity, and can be re-triggered on every reconnect attempt for a persistent denial of service. Firmware re-init after such asserts can also fail outright, leaving the adapter unusable until reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:47.522Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b4f1b0b3b91762edd19bf9d3b2e4c3a0740501f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/40405cbb20eb6541c603e7b3d54ade0a7be9d715"
        },
        {
          "url": "https://git.kernel.org/stable/c/60f6d5fc84a9fd26528a24d8a267fc6a6698b628"
        },
        {
          "url": "https://git.kernel.org/stable/c/e35f316bce9e5733c9826120c1838f4c447b2c4c"
        }
      ],
      "title": "wifi: iwlwifi: mvm: don\u0027t set the MFP flag for the GTK",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27434",
    "datePublished": "2024-05-17T12:08:50.896Z",
    "dateReserved": "2024-02-25T13:47:42.687Z",
    "dateUpdated": "2026-08-05T11:29:47.522Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-27434",
      "date": "2026-08-05",
      "epss": "0.00295",
      "percentile": "0.21661"
    },
    "microsoft_vex": {
      "current_release_date": "2024-09-11T00:00:00.000Z",
      "cve": "CVE-2024-27434",
      "id": "msrc_CVE-2024-27434",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: iwlwifi: mvm: don\u0027t set the MFP flag for the GTK",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-27434.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-27434\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T13:15:58.000\",\"lastModified\":\"2026-06-17T07:19:53.340\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: iwlwifi: mvm: don\u0027t set the MFP flag for the GTK\\n\\nThe firmware doesn\u0027t need the MFP flag for the GTK, it can even make the\\nfirmware crash. in case the AP is configured with: group cipher TKIP and\\nMFPC. We would send the GTK with cipher = TKIP and MFP which is of course\\nnot possible.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: iwlwifi: mvm: no configure el indicador MFP para GTK El firmware no necesita el indicador MFP para GTK, incluso puede provocar que el firmware falle. en caso de que el AP est\u00e9 configurado con: cifrado de grupo TKIP y MFPC. Enviar\u00edamos el GTK con cifrado = TKIP y MFP, lo cual, por supuesto, no es posible.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/intel/iwlwifi/mvm/mld-key.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5c75a208c2449c6ea24f07610cc052f6a352246c\",\"lessThan\":\"b4f1b0b3b91762edd19bf9d3b2e4c3a0740501f8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5c75a208c2449c6ea24f07610cc052f6a352246c\",\"lessThan\":\"40405cbb20eb6541c603e7b3d54ade0a7be9d715\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5c75a208c2449c6ea24f07610cc052f6a352246c\",\"lessThan\":\"60f6d5fc84a9fd26528a24d8a267fc6a6698b628\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5c75a208c2449c6ea24f07610cc052f6a352246c\",\"lessThan\":\"e35f316bce9e5733c9826120c1838f4c447b2c4c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/intel/iwlwifi/mvm/mld-key.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.23\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.11\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.2\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-17T17:16:46.787202Z\",\"id\":\"CVE-2024-27434\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.23\",\"matchCriteriaId\":\"E00814DC-0BA7-431A-9926-80FEB4A96C68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.11\",\"matchCriteriaId\":\"9B95D3A6-E162-47D5-ABFC-F3FA74FA7CFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.8.2\",\"matchCriteriaId\":\"543A75FF-25B8-4046-A514-1EA8EDD87AB1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/40405cbb20eb6541c603e7b3d54ade0a7be9d715\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/60f6d5fc84a9fd26528a24d8a267fc6a6698b628\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b4f1b0b3b91762edd19bf9d3b2e4c3a0740501f8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e35f316bce9e5733c9826120c1838f4c447b2c4c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/40405cbb20eb6541c603e7b3d54ade0a7be9d715\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/60f6d5fc84a9fd26528a24d8a267fc6a6698b628\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b4f1b0b3b91762edd19bf9d3b2e4c3a0740501f8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e35f316bce9e5733c9826120c1838f4c447b2c4c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:06:40+00:00",
      "cve": "CVE-2024-27434",
      "id": "CVE-2024-27434",
      "initial_release_date": "2024-05-17T00:00:00+00:00",
      "product_status:fixed": "429",
      "product_status:known_affected": "50",
      "product_status:known_not_affected": "22",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: iwlwifi: mvm: don\u0026#39;t set the MFP flag for the GTK",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-27434.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b4f1b0b3b91762edd19bf9d3b2e4c3a0740501f8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/40405cbb20eb6541c603e7b3d54ade0a7be9d715\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/60f6d5fc84a9fd26528a24d8a267fc6a6698b628\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e35f316bce9e5733c9826120c1838f4c447b2c4c\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:34:52.476Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-27434\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-17T17:16:46.787202Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:24.665Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"wifi: iwlwifi: mvm: don\u0027t set the MFP flag for the GTK\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:A - The trigger is entirely controlled by the 802.11 peer (AP) via its advertised RSN group cipher and MFPC capability, consumed during association/4-way handshake by a Wi-Fi client. This requires the attacker to be within radio range on the same wireless segment, i.e. adjacent network.\\nAC:L - An attacker operating an AP (including an evil twin on a network whose PSK is known or shared, such as caf\\u00e9/office/guest Wi-Fi) fully controls the required configuration \\u2014 group cipher TKIP with MFPC \\u2014 and the crash follows deterministically on GTK installation, with no race or memory-layout dependency. The other precondition (PMF negotiated, so `sta-\u003emfp` is set) is the default on modern supplicants.\\nPR:N - The attacker needs no account, capability, or any privilege on the victim system; they merely configure the AP the client associates with. No local access or kernel-side authorization is involved on the target.\\nUI:N - wpa_supplicant/NetworkManager auto-reconnect to a known SSID after a deauth means the association and GTK installation happen with no user action. The vulnerable code runs as part of normal automated connection setup.\\nS:U - The consequences are confined to the Wi-Fi device and the kernel driver managing it \\u2014 the same security authority as the vulnerable component. No VM, IOMMU, or sandbox boundary is crossed.\\nC:N - The defect is an incorrect flag bit in a firmware command; there is no out-of-bounds read, uninitialized data disclosure, or leak of kernel memory to the attacker.\\nI:L - The group key is installed in firmware with the wrong protection semantics \\u2014 flagged as en/decrypting management frames when a non-iGTK group key must not be \\u2014 so management-frame protection state for the GTK is incorrect, which any group member could attempt to abuse for forged \\\"protected\\\" broadcast management frames. This is bounded, not arbitrary, modification.\\nA:H - The malformed TKIP+MFP key command asserts the firmware, producing a SW-error dump and a full NIC restart with loss of wireless connectivity, and can be re-triggered on every reconnect attempt for a persistent denial of service. Firmware re-init after such asserts can also fail outright, leaving the adapter unusable until reboot.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5c75a208c2449c6ea24f07610cc052f6a352246c\", \"lessThan\": \"b4f1b0b3b91762edd19bf9d3b2e4c3a0740501f8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5c75a208c2449c6ea24f07610cc052f6a352246c\", \"lessThan\": \"40405cbb20eb6541c603e7b3d54ade0a7be9d715\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5c75a208c2449c6ea24f07610cc052f6a352246c\", \"lessThan\": \"60f6d5fc84a9fd26528a24d8a267fc6a6698b628\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5c75a208c2449c6ea24f07610cc052f6a352246c\", \"lessThan\": \"e35f316bce9e5733c9826120c1838f4c447b2c4c\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/wireless/intel/iwlwifi/mvm/mld-key.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.23\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/wireless/intel/iwlwifi/mvm/mld-key.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b4f1b0b3b91762edd19bf9d3b2e4c3a0740501f8\"}, {\"url\": \"https://git.kernel.org/stable/c/40405cbb20eb6541c603e7b3d54ade0a7be9d715\"}, {\"url\": \"https://git.kernel.org/stable/c/60f6d5fc84a9fd26528a24d8a267fc6a6698b628\"}, {\"url\": \"https://git.kernel.org/stable/c/e35f316bce9e5733c9826120c1838f4c447b2c4c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: iwlwifi: mvm: don\u0027t set the MFP flag for the GTK\\n\\nThe firmware doesn\u0027t need the MFP flag for the GTK, it can even make the\\nfirmware crash. in case the AP is configured with: group cipher TKIP and\\nMFPC. We would send the GTK with cipher = TKIP and MFP which is of course\\nnot possible.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.23\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.11\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.2\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:29:47.522Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-27434\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:29:47.522Z\", \"dateReserved\": \"2024-02-25T13:47:42.687Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-17T12:08:50.896Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.