GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-38572 (GCVE-0-2024-38572)

Vulnerability from cvelistv5 – Published: 2024-06-19 13:35 – Updated: 2026-08-05 11:32
VLAI
Title
wifi: ath12k: fix out-of-bound access of qmi_invoke_handler()
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bound access of qmi_invoke_handler() Currently, there is no terminator entry for ath12k_qmi_msg_handlers hence facing below KASAN warning, ================================================================== BUG: KASAN: global-out-of-bounds in qmi_invoke_handler+0xa4/0x148 Read of size 8 at addr ffffffd00a6428d8 by task kworker/u8:2/1273 CPU: 0 PID: 1273 Comm: kworker/u8:2 Not tainted 5.4.213 #0 Workqueue: qmi_msg_handler qmi_data_ready_work Call trace: dump_backtrace+0x0/0x20c show_stack+0x14/0x1c dump_stack+0xe0/0x138 print_address_description.isra.5+0x30/0x330 __kasan_report+0x16c/0x1bc kasan_report+0xc/0x14 __asan_load8+0xa8/0xb0 qmi_invoke_handler+0xa4/0x148 qmi_handle_message+0x18c/0x1bc qmi_data_ready_work+0x4ec/0x528 process_one_work+0x2c0/0x440 worker_thread+0x324/0x4b8 kthread+0x210/0x228 ret_from_fork+0x10/0x18 The address belongs to the variable: ath12k_mac_mon_status_filter_default+0x4bd8/0xfffffffffffe2300 [ath12k] [...] ================================================================== Add a dummy terminator entry at the end to assist the qmi_invoke_handler() in traversing up to the terminator entry without accessing an out-of-boundary index. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 17:14 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < 95575de7dede7b1ed3b9718dab9dda97914ea775 (git)
Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < b48d40f5840c505b7af700594aa8379eec28e925 (git)
Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < a1abdb63628b04855a929850772de97435ed1555 (git)
Affected: d889913205cf7ebda905b1e62c5867ed4e39f6c2 , < e1bdff48a1bb4a4ac660c19c55a820968c48b3f2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.33 , ≤ 6.6.* (semver)
Unaffected: 6.8.12 , ≤ 6.8.* (semver)
Unaffected: 6.9.3 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:25.824Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/95575de7dede7b1ed3b9718dab9dda97914ea775"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b48d40f5840c505b7af700594aa8379eec28e925"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a1abdb63628b04855a929850772de97435ed1555"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e1bdff48a1bb4a4ac660c19c55a820968c48b3f2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38572",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:14:15.867309Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:56.056Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/qmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "95575de7dede7b1ed3b9718dab9dda97914ea775",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            },
            {
              "lessThan": "b48d40f5840c505b7af700594aa8379eec28e925",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            },
            {
              "lessThan": "a1abdb63628b04855a929850772de97435ed1555",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            },
            {
              "lessThan": "e1bdff48a1bb4a4ac660c19c55a820968c48b3f2",
              "status": "affected",
              "version": "d889913205cf7ebda905b1e62c5867ed4e39f6c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/qmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.12",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix out-of-bound access of qmi_invoke_handler()\n\nCurrently, there is no terminator entry for ath12k_qmi_msg_handlers hence\nfacing below KASAN warning,\n\n ==================================================================\n BUG: KASAN: global-out-of-bounds in qmi_invoke_handler+0xa4/0x148\n Read of size 8 at addr ffffffd00a6428d8 by task kworker/u8:2/1273\n\n CPU: 0 PID: 1273 Comm: kworker/u8:2 Not tainted 5.4.213 #0\n Workqueue: qmi_msg_handler qmi_data_ready_work\n Call trace:\n  dump_backtrace+0x0/0x20c\n  show_stack+0x14/0x1c\n  dump_stack+0xe0/0x138\n  print_address_description.isra.5+0x30/0x330\n  __kasan_report+0x16c/0x1bc\n  kasan_report+0xc/0x14\n  __asan_load8+0xa8/0xb0\n  qmi_invoke_handler+0xa4/0x148\n  qmi_handle_message+0x18c/0x1bc\n  qmi_data_ready_work+0x4ec/0x528\n  process_one_work+0x2c0/0x440\n  worker_thread+0x324/0x4b8\n  kthread+0x210/0x228\n  ret_from_fork+0x10/0x18\n\n The address belongs to the variable:\n  ath12k_mac_mon_status_filter_default+0x4bd8/0xfffffffffffe2300 [ath12k]\n [...]\n ==================================================================\n\nAdd a dummy terminator entry at the end to assist the qmi_invoke_handler()\nin traversing up to the terminator entry without accessing an\nout-of-boundary index.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached by sending a datagram to the ath12k QMI handle\u0027s socket over the local AF_QIPCRTR (QRTR) IPC transport, which requires local system access. QMI is a host-to-firmware control channel and is not exposed to over-the-air or network peers.\nAC:L - The attacker fully controls the QMI header\u0027s type and msg_id fields, so simply sending any value not present in the 3-entry handler table deterministically walks past the array end; the destination ephemeral port range is only 0x4000-0x7fff and is trivially scanned. No race, timing, or uncontrollable precondition is involved.\nPR:L - qrtr_create() performs no capability check for AF_QIPCRTR/SOCK_DGRAM, qrtr_sendmsg() autobinds to an ephemeral port and delivers via the global (non-netns-scoped) qrtr_ports XArray, and qmi_handle_message() does no sender validation for non-response messages, so any unprivileged local user can reach it. Only binding below QRTR_MIN_EPH_SOCKET needs CAP_NET_ADMIN, which is not required here.\nUI:N - The attacker triggers the out-of-bounds access entirely on their own by sending a single crafted QMI datagram. No victim action is needed, and the bug also fires spontaneously on any unrecognized firmware indication.\nS:U - The out-of-bounds read, the resulting corruption, and the wild indirect call all occur within the kernel\u0027s own security authority on the same host. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The loop performs an unbounded out-of-bounds read that walks arbitrary module .rodata until it happens to find a slot with a NULL fn field, and the attacker steers which slot is selected via the type/msg_id he controls. Combined with the garbage qmi_elem_info pointer fed to qmi_decode_message(), this yields wild kernel memory reads well beyond a few bounded bytes.\nI:H - An attacker-selected out-of-bounds slot supplies a bogus ei pointer to qmi_decode_message(), whose qmi_decode() writes elem_len * elem_size bytes at c_struct + ei-\u003eoffset \u2014 an out-of-bounds heap write \u2014 and then calls handler-\u003efn(), an indirect call through an unvalidated pointer read from out-of-bounds memory, giving a control-flow hijack primitive.\nA:H - The out-of-bounds walk can run off the end of the module mapping and the subsequent decode/indirect call through garbage pointers reliably oopses the kernel, as demonstrated by the KASAN global-out-of-bounds report in the fix commit. It is triggerable repeatedly from an unprivileged process."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:32:52.528Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/95575de7dede7b1ed3b9718dab9dda97914ea775"
        },
        {
          "url": "https://git.kernel.org/stable/c/b48d40f5840c505b7af700594aa8379eec28e925"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1abdb63628b04855a929850772de97435ed1555"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1bdff48a1bb4a4ac660c19c55a820968c48b3f2"
        }
      ],
      "title": "wifi: ath12k: fix out-of-bound access of qmi_invoke_handler()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38572",
    "datePublished": "2024-06-19T13:35:37.666Z",
    "dateReserved": "2024-06-18T19:36:34.924Z",
    "dateUpdated": "2026-08-05T11:32:52.528Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-38572",
      "date": "2026-09-17",
      "epss": "0.00234",
      "percentile": "0.14482"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-38572\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-19T14:15:17.333\",\"lastModified\":\"2026-08-04T11:18:45.773\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath12k: fix out-of-bound access of qmi_invoke_handler()\\n\\nCurrently, there is no terminator entry for ath12k_qmi_msg_handlers hence\\nfacing below KASAN warning,\\n\\n ==================================================================\\n BUG: KASAN: global-out-of-bounds in qmi_invoke_handler+0xa4/0x148\\n Read of size 8 at addr ffffffd00a6428d8 by task kworker/u8:2/1273\\n\\n CPU: 0 PID: 1273 Comm: kworker/u8:2 Not tainted 5.4.213 #0\\n Workqueue: qmi_msg_handler qmi_data_ready_work\\n Call trace:\\n  dump_backtrace+0x0/0x20c\\n  show_stack+0x14/0x1c\\n  dump_stack+0xe0/0x138\\n  print_address_description.isra.5+0x30/0x330\\n  __kasan_report+0x16c/0x1bc\\n  kasan_report+0xc/0x14\\n  __asan_load8+0xa8/0xb0\\n  qmi_invoke_handler+0xa4/0x148\\n  qmi_handle_message+0x18c/0x1bc\\n  qmi_data_ready_work+0x4ec/0x528\\n  process_one_work+0x2c0/0x440\\n  worker_thread+0x324/0x4b8\\n  kthread+0x210/0x228\\n  ret_from_fork+0x10/0x18\\n\\n The address belongs to the variable:\\n  ath12k_mac_mon_status_filter_default+0x4bd8/0xfffffffffffe2300 [ath12k]\\n [...]\\n ==================================================================\\n\\nAdd a dummy terminator entry at the end to assist the qmi_invoke_handler()\\nin traversing up to the terminator entry without accessing an\\nout-of-boundary index.\\n\\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath12k: corrige el acceso fuera de los l\u00edmites de qmi_invoke_handler() Actualmente, no hay ninguna entrada de terminador para ath12k_qmi_msg_handlers, por lo que se enfrenta a la siguiente advertencia de KASAN, ======== ==================================================== ======== ERROR: KASAN: global fuera de los l\u00edmites en qmi_invoke_handler+0xa4/0x148 Lectura de tama\u00f1o 8 en la direcci\u00f3n ffffffd00a6428d8 por tarea kworker/u8:2/1273 CPU: 0 PID: 1273 Comm: kworker /u8:2 No contaminado 5.4.213 #0 Cola de trabajo: qmi_msg_handler qmi_data_ready_work Rastreo de llamadas: dump_backtrace+0x0/0x20c show_stack+0x14/0x1c dump_stack+0xe0/0x138 print_address_description.isra.5+0x30/0x330 __kasan_report+0x16 c/0x1bc kasan_report+0xc /0x14 __asan_load8+0xa8/0xb0 qmi_invoke_handler+0xa4/0x148 qmi_handle_message+0x18c/0x1bc qmi_data_ready_work+0x4ec/0x528 Process_one_work+0x2c0/0x440 trabajador_thread+0x324/0x4b8 0x228 ret_from_fork+0x10/0x18 La direcci\u00f3n pertenece a la variable: ath12k_mac_mon_status_filter_default +0x4bd8/0xfffffffffffe2300 [ath12k] [...] ======================================= ============================ Agregue una entrada de terminador ficticia al final para ayudar a qmi_invoke_handler() a atravesar hasta la entrada del terminador sin acceder a un \u00edndice fuera de los l\u00edmites. Probado en: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/ath/ath12k/qmi.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d889913205cf7ebda905b1e62c5867ed4e39f6c2\",\"lessThan\":\"95575de7dede7b1ed3b9718dab9dda97914ea775\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d889913205cf7ebda905b1e62c5867ed4e39f6c2\",\"lessThan\":\"b48d40f5840c505b7af700594aa8379eec28e925\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d889913205cf7ebda905b1e62c5867ed4e39f6c2\",\"lessThan\":\"a1abdb63628b04855a929850772de97435ed1555\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d889913205cf7ebda905b1e62c5867ed4e39f6c2\",\"lessThan\":\"e1bdff48a1bb4a4ac660c19c55a820968c48b3f2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/ath/ath12k/qmi.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.33\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.12\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.3\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:14:15.867309Z\",\"id\":\"CVE-2024-38572\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3\",\"versionEndExcluding\":\"6.6.33\",\"matchCriteriaId\":\"23CACAE0-7893-46F0-8796-BB256AF77F59\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.12\",\"matchCriteriaId\":\"80550309-67AB-4FD1-AC07-3DED5C4F01B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.9.3\",\"matchCriteriaId\":\"E07124C1-19E8-4D21-828D-9932A01D3011\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/95575de7dede7b1ed3b9718dab9dda97914ea775\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a1abdb63628b04855a929850772de97435ed1555\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b48d40f5840c505b7af700594aa8379eec28e925\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e1bdff48a1bb4a4ac660c19c55a820968c48b3f2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/95575de7dede7b1ed3b9718dab9dda97914ea775\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a1abdb63628b04855a929850772de97435ed1555\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b48d40f5840c505b7af700594aa8379eec28e925\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e1bdff48a1bb4a4ac660c19c55a820968c48b3f2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:46:18+00:00",
      "cve": "CVE-2024-38572",
      "id": "CVE-2024-38572",
      "initial_release_date": "2024-06-19T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: ath12k: fix out-of-bound access of qmi_invoke_handler()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-38572.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/95575de7dede7b1ed3b9718dab9dda97914ea775\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b48d40f5840c505b7af700594aa8379eec28e925\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a1abdb63628b04855a929850772de97435ed1555\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e1bdff48a1bb4a4ac660c19c55a820968c48b3f2\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:12:25.824Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-38572\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:14:15.867309Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:26.951Z\"}}], \"cna\": {\"title\": \"wifi: ath12k: fix out-of-bound access of qmi_invoke_handler()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached by sending a datagram to the ath12k QMI handle\u0027s socket over the local AF_QIPCRTR (QRTR) IPC transport, which requires local system access. QMI is a host-to-firmware control channel and is not exposed to over-the-air or network peers.\\nAC:L - The attacker fully controls the QMI header\u0027s type and msg_id fields, so simply sending any value not present in the 3-entry handler table deterministically walks past the array end; the destination ephemeral port range is only 0x4000-0x7fff and is trivially scanned. No race, timing, or uncontrollable precondition is involved.\\nPR:L - qrtr_create() performs no capability check for AF_QIPCRTR/SOCK_DGRAM, qrtr_sendmsg() autobinds to an ephemeral port and delivers via the global (non-netns-scoped) qrtr_ports XArray, and qmi_handle_message() does no sender validation for non-response messages, so any unprivileged local user can reach it. Only binding below QRTR_MIN_EPH_SOCKET needs CAP_NET_ADMIN, which is not required here.\\nUI:N - The attacker triggers the out-of-bounds access entirely on their own by sending a single crafted QMI datagram. No victim action is needed, and the bug also fires spontaneously on any unrecognized firmware indication.\\nS:U - The out-of-bounds read, the resulting corruption, and the wild indirect call all occur within the kernel\u0027s own security authority on the same host. No hypervisor, IOMMU, or sandbox boundary is crossed.\\nC:H - The loop performs an unbounded out-of-bounds read that walks arbitrary module .rodata until it happens to find a slot with a NULL fn field, and the attacker steers which slot is selected via the type/msg_id he controls. Combined with the garbage qmi_elem_info pointer fed to qmi_decode_message(), this yields wild kernel memory reads well beyond a few bounded bytes.\\nI:H - An attacker-selected out-of-bounds slot supplies a bogus ei pointer to qmi_decode_message(), whose qmi_decode() writes elem_len * elem_size bytes at c_struct + ei-\u003eoffset \\u2014 an out-of-bounds heap write \\u2014 and then calls handler-\u003efn(), an indirect call through an unvalidated pointer read from out-of-bounds memory, giving a control-flow hijack primitive.\\nA:H - The out-of-bounds walk can run off the end of the module mapping and the subsequent decode/indirect call through garbage pointers reliably oopses the kernel, as demonstrated by the KASAN global-out-of-bounds report in the fix commit. It is triggerable repeatedly from an unprivileged process.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d889913205cf7ebda905b1e62c5867ed4e39f6c2\", \"lessThan\": \"95575de7dede7b1ed3b9718dab9dda97914ea775\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d889913205cf7ebda905b1e62c5867ed4e39f6c2\", \"lessThan\": \"b48d40f5840c505b7af700594aa8379eec28e925\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d889913205cf7ebda905b1e62c5867ed4e39f6c2\", \"lessThan\": \"a1abdb63628b04855a929850772de97435ed1555\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d889913205cf7ebda905b1e62c5867ed4e39f6c2\", \"lessThan\": \"e1bdff48a1bb4a4ac660c19c55a820968c48b3f2\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/wireless/ath/ath12k/qmi.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.3\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.3\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/wireless/ath/ath12k/qmi.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/95575de7dede7b1ed3b9718dab9dda97914ea775\"}, {\"url\": \"https://git.kernel.org/stable/c/b48d40f5840c505b7af700594aa8379eec28e925\"}, {\"url\": \"https://git.kernel.org/stable/c/a1abdb63628b04855a929850772de97435ed1555\"}, {\"url\": \"https://git.kernel.org/stable/c/e1bdff48a1bb4a4ac660c19c55a820968c48b3f2\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ath12k: fix out-of-bound access of qmi_invoke_handler()\\n\\nCurrently, there is no terminator entry for ath12k_qmi_msg_handlers hence\\nfacing below KASAN warning,\\n\\n ==================================================================\\n BUG: KASAN: global-out-of-bounds in qmi_invoke_handler+0xa4/0x148\\n Read of size 8 at addr ffffffd00a6428d8 by task kworker/u8:2/1273\\n\\n CPU: 0 PID: 1273 Comm: kworker/u8:2 Not tainted 5.4.213 #0\\n Workqueue: qmi_msg_handler qmi_data_ready_work\\n Call trace:\\n  dump_backtrace+0x0/0x20c\\n  show_stack+0x14/0x1c\\n  dump_stack+0xe0/0x138\\n  print_address_description.isra.5+0x30/0x330\\n  __kasan_report+0x16c/0x1bc\\n  kasan_report+0xc/0x14\\n  __asan_load8+0xa8/0xb0\\n  qmi_invoke_handler+0xa4/0x148\\n  qmi_handle_message+0x18c/0x1bc\\n  qmi_data_ready_work+0x4ec/0x528\\n  process_one_work+0x2c0/0x440\\n  worker_thread+0x324/0x4b8\\n  kthread+0x210/0x228\\n  ret_from_fork+0x10/0x18\\n\\n The address belongs to the variable:\\n  ath12k_mac_mon_status_filter_default+0x4bd8/0xfffffffffffe2300 [ath12k]\\n [...]\\n ==================================================================\\n\\nAdd a dummy terminator entry at the end to assist the qmi_invoke_handler()\\nin traversing up to the terminator entry without accessing an\\nout-of-boundary index.\\n\\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.33\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.12\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.3\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"6.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:32:52.528Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-38572\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:32:52.528Z\", \"dateReserved\": \"2024-06-18T19:36:34.924Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-19T13:35:37.666Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.