Vulnerability-Lookup

FKIE_CVE-2024-35789

Vulnerability from fkie_nvd - Published: 2024-05-17 13:15 - Updated: 2026-10-15 01:17

Severity

8.0 (High) - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes When moving a station out of a VLAN and deleting the VLAN afterwards, the fast_rx entry still holds a pointer to the VLAN's netdev, which can cause use-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx after the VLAN change.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/2884a50f52313a7a911de3afcad065ddbb3d78fc	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/4f2bdb3c5e3189297e156b3ff84b140423d64685	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/6b948b54c8bd620725e0c906e44b10c0b13087a7	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/be1dd9254fc115321d6fbee042026d42afc8d931	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/c8bddbd91bc8e42c961a5e2cec20ab879f21100f	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/e8678551c0243f799b4859448781cbec1bd6f1cb	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/e8b067c4058c0121ac8ca71559df8e2e08ff1a7e	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ea9a0cfc07a7d3601cc680718d9cff0d6927a921	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/2884a50f52313a7a911de3afcad065ddbb3d78fc	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/4f2bdb3c5e3189297e156b3ff84b140423d64685	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/6b948b54c8bd620725e0c906e44b10c0b13087a7	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/be1dd9254fc115321d6fbee042026d42afc8d931	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/c8bddbd91bc8e42c961a5e2cec20ab879f21100f	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/e8678551c0243f799b4859448781cbec1bd6f1cb	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/e8b067c4058c0121ac8ca71559df8e2e08ff1a7e	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/ea9a0cfc07a7d3601cc680718d9cff0d6927a921	Patch
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html	Third Party Advisory
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e	https://cert-portal.siemens.com/productcert/html/ssa-265688.html

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	5.12
linux	linux_kernel	5.12
linux	linux_kernel	5.12
linux	linux_kernel	6.9
debian	debian_linux	10.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/cfg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ea9a0cfc07a7d3601cc680718d9cff0d6927a921",
              "status": "affected",
              "version": "a7f1721684628b8ae6015bca9a176046ee6f30cc",
              "versionType": "git"
            },
            {
              "lessThan": "be1dd9254fc115321d6fbee042026d42afc8d931",
              "status": "affected",
              "version": "bd7e90c82850f49c23004d54de14e46d373748a6",
              "versionType": "git"
            },
            {
              "lessThan": "e8b067c4058c0121ac8ca71559df8e2e08ff1a7e",
              "status": "affected",
              "version": "cc413b375c6d95e68a4629cb1ba9d099de78ebb9",
              "versionType": "git"
            },
            {
              "lessThan": "c8bddbd91bc8e42c961a5e2cec20ab879f21100f",
              "status": "affected",
              "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd",
              "versionType": "git"
            },
            {
              "lessThan": "7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b",
              "status": "affected",
              "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd",
              "versionType": "git"
            },
            {
              "lessThan": "6b948b54c8bd620725e0c906e44b10c0b13087a7",
              "status": "affected",
              "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd",
              "versionType": "git"
            },
            {
              "lessThan": "2884a50f52313a7a911de3afcad065ddbb3d78fc",
              "status": "affected",
              "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd",
              "versionType": "git"
            },
            {
              "lessThan": "e8678551c0243f799b4859448781cbec1bd6f1cb",
              "status": "affected",
              "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd",
              "versionType": "git"
            },
            {
              "lessThan": "4f2bdb3c5e3189297e156b3ff84b140423d64685",
              "status": "affected",
              "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "22bc2a4814440c4a8979a381f46fec5d224f5c11",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7cfe824f681e1aaac34ea64bb4def8a77801b672",
              "versionType": "git"
            },
            {
              "lessThan": "4.19.312",
              "status": "affected",
              "version": "4.19.189",
              "versionType": "semver"
            },
            {
              "lessThan": "5.4.274",
              "status": "affected",
              "version": "5.4.114",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.215",
              "status": "affected",
              "version": "5.10.32",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.232",
              "versionType": "semver"
            },
            {
              "lessThan": "5.12",
              "status": "affected",
              "version": "5.11.16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/cfg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.312",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.274",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.215",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V1.1.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "563581F9-6B9B-4F5E-B3EA-D8BB8B19551E",
              "versionEndExcluding": "4.15",
              "versionStartIncluding": "4.14.232",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F7A8056E-6D7E-4E0F-A2B2-F8EBF10FF9FF",
              "versionEndExcluding": "4.19.312",
              "versionStartIncluding": "4.19.189",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "64646F81-7DCA-483B-9378-C94B7D86E7C8",
              "versionEndExcluding": "5.4.274",
              "versionStartIncluding": "5.4.114",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C2086275-1CDE-450C-A609-98FA1C90F10E",
              "versionEndExcluding": "5.10.215",
              "versionStartIncluding": "5.10.32",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "10040772-1DE1-4DA5-91D0-3DDC17BCD2CD",
              "versionEndExcluding": "5.12",
              "versionStartIncluding": "5.11.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "79EF2A88-2B19-4725-889C-B6CE14595A85",
              "versionEndExcluding": "5.15.154",
              "versionStartIncluding": "5.12.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "834D9BD5-42A6-4D74-979E-4D6D93F630FD",
              "versionEndExcluding": "6.1.84",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8018C1D0-0A5F-48D0-BC72-A2B33FDDA693",
              "versionEndExcluding": "6.6.24",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6BE9771A-BAFD-4624-95F9-58D536540C53",
              "versionEndExcluding": "6.7.12",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4C59BBC3-6495-4A77-9C82-55EC7CDF5E02",
              "versionEndExcluding": "6.8.3",
              "versionStartIncluding": "6.8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.12:-:*:*:*:*:*:*",
              "matchCriteriaId": "75EB504D-4A83-4C67-9C8D-FD9C6C8EB4CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.12:rc7:*:*:*:*:*:*",
              "matchCriteriaId": "06AE06A6-A0C3-4556-BFFA-3D6E4BAC43C8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.12:rc8:*:*:*:*:*:*",
              "matchCriteriaId": "FCE63934-38CF-4311-AD72-624E86AF3889",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes\n\nWhen moving a station out of a VLAN and deleting the VLAN afterwards, the\nfast_rx entry still holds a pointer to the VLAN\u0027s netdev, which can cause\nuse-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx\nafter the VLAN change."
    },
    {
      "lang": "es",
      "value": " En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mac80211: comprobar/borrar fast rx para cambios de VLAN que no sean 4addr sta Al mover una estaci\u00f3n fuera de una VLAN y eliminar la VLAN despu\u00e9s, la entrada fast_rx todav\u00eda contiene un puntero a netdev de la VLAN, lo que puede causar errores de uso despu\u00e9s de la liberaci\u00f3n. Solucione este problema llamando inmediatamente a ieee80211_check_fast_rx despu\u00e9s del cambio de VLAN."
    }
  ],
  "id": "CVE-2024-35789",
  "lastModified": "2026-10-15T01:17:46.277",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-35789",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-05-24T14:19:23.131138Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-05-17T13:15:58.717",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/2884a50f52313a7a911de3afcad065ddbb3d78fc"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/4f2bdb3c5e3189297e156b3ff84b140423d64685"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/6b948b54c8bd620725e0c906e44b10c0b13087a7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/be1dd9254fc115321d6fbee042026d42afc8d931"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/c8bddbd91bc8e42c961a5e2cec20ab879f21100f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/e8678551c0243f799b4859448781cbec1bd6f1cb"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/e8b067c4058c0121ac8ca71559df8e2e08ff1a7e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/ea9a0cfc07a7d3601cc680718d9cff0d6927a921"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/2884a50f52313a7a911de3afcad065ddbb3d78fc"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/4f2bdb3c5e3189297e156b3ff84b140423d64685"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/6b948b54c8bd620725e0c906e44b10c0b13087a7"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/be1dd9254fc115321d6fbee042026d42afc8d931"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/c8bddbd91bc8e42c961a5e2cec20ab879f21100f"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/e8678551c0243f799b4859448781cbec1bd6f1cb"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/e8b067c4058c0121ac8ca71559df8e2e08ff1a7e"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/ea9a0cfc07a7d3601cc680718d9cff0d6927a921"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
    },
    {
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2024-35789 (GCVE-0-2024-35789)

Vulnerability from cvelistv5 – Published: 2024-05-17 12:24 – Updated: 2026-10-15 00:40

Title

wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes

Summary

Severity

8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-24 14:19 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6653 records in the last 180 days details

References

12 references

URL	Tags
https://git.kernel.org/stable/c/ea9a0cfc07a7d3601…
https://git.kernel.org/stable/c/be1dd9254fc115321…
https://git.kernel.org/stable/c/e8b067c4058c0121a…
https://git.kernel.org/stable/c/c8bddbd91bc8e42c9…
https://git.kernel.org/stable/c/7eeabcea79b67cc29…
https://git.kernel.org/stable/c/6b948b54c8bd62072…
https://git.kernel.org/stable/c/2884a50f52313a7a9…
https://git.kernel.org/stable/c/e8678551c0243f799…
https://git.kernel.org/stable/c/4f2bdb3c5e3189297…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: a7f1721684628b8ae6015bca9a176046ee6f30cc , < ea9a0cfc07a7d3601cc680718d9cff0d6927a921 (git) Affected: bd7e90c82850f49c23004d54de14e46d373748a6 , < be1dd9254fc115321d6fbee042026d42afc8d931 (git) Affected: cc413b375c6d95e68a4629cb1ba9d099de78ebb9 , < e8b067c4058c0121ac8ca71559df8e2e08ff1a7e (git) Affected: dd0b45538146cb6a54d6da7663b8c3afd16ebcfd , < c8bddbd91bc8e42c961a5e2cec20ab879f21100f (git) Affected: dd0b45538146cb6a54d6da7663b8c3afd16ebcfd , < 7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b (git) Affected: dd0b45538146cb6a54d6da7663b8c3afd16ebcfd , < 6b948b54c8bd620725e0c906e44b10c0b13087a7 (git) Affected: dd0b45538146cb6a54d6da7663b8c3afd16ebcfd , < 2884a50f52313a7a911de3afcad065ddbb3d78fc (git) Affected: dd0b45538146cb6a54d6da7663b8c3afd16ebcfd , < e8678551c0243f799b4859448781cbec1bd6f1cb (git) Affected: dd0b45538146cb6a54d6da7663b8c3afd16ebcfd , < 4f2bdb3c5e3189297e156b3ff84b140423d64685 (git) Affected: 22bc2a4814440c4a8979a381f46fec5d224f5c11 (git) Affected: 7cfe824f681e1aaac34ea64bb4def8a77801b672 (git) Affected: 4.19.189 , < 4.19.312 (semver) Affected: 5.4.114 , < 5.4.274 (semver) Affected: 5.10.32 , < 5.10.215 (semver) Affected: 4.14.232 , < 4.15 (semver) Affected: 5.11.16 , < 5.12 (semver)
Linux	Linux	Affected: 5.12 Unaffected: 0 , < 5.12 (semver) Unaffected: 4.19.312 , ≤ 4.19.* (semver) Unaffected: 5.4.274 , ≤ 5.4.* (semver) Unaffected: 5.10.215 , ≤ 5.10.* (semver) Unaffected: 5.15.154 , ≤ 5.15.* (semver) Unaffected: 6.1.84 , ≤ 6.1.* (semver) Unaffected: 6.6.24 , ≤ 6.6.* (semver) Unaffected: 6.7.12 , ≤ 6.7.* (semver) Unaffected: 6.8.3 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < V1.1.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35789",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-24T14:19:23.131138Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:33:29.281Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:47.402Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ea9a0cfc07a7d3601cc680718d9cff0d6927a921"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/be1dd9254fc115321d6fbee042026d42afc8d931"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e8b067c4058c0121ac8ca71559df8e2e08ff1a7e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c8bddbd91bc8e42c961a5e2cec20ab879f21100f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6b948b54c8bd620725e0c906e44b10c0b13087a7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2884a50f52313a7a911de3afcad065ddbb3d78fc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e8678551c0243f799b4859448781cbec1bd6f1cb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4f2bdb3c5e3189297e156b3ff84b140423d64685"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V1.1.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T00:40:48.629Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/cfg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ea9a0cfc07a7d3601cc680718d9cff0d6927a921",
              "status": "affected",
              "version": "a7f1721684628b8ae6015bca9a176046ee6f30cc",
              "versionType": "git"
            },
            {
              "lessThan": "be1dd9254fc115321d6fbee042026d42afc8d931",
              "status": "affected",
              "version": "bd7e90c82850f49c23004d54de14e46d373748a6",
              "versionType": "git"
            },
            {
              "lessThan": "e8b067c4058c0121ac8ca71559df8e2e08ff1a7e",
              "status": "affected",
              "version": "cc413b375c6d95e68a4629cb1ba9d099de78ebb9",
              "versionType": "git"
            },
            {
              "lessThan": "c8bddbd91bc8e42c961a5e2cec20ab879f21100f",
              "status": "affected",
              "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd",
              "versionType": "git"
            },
            {
              "lessThan": "7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b",
              "status": "affected",
              "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd",
              "versionType": "git"
            },
            {
              "lessThan": "6b948b54c8bd620725e0c906e44b10c0b13087a7",
              "status": "affected",
              "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd",
              "versionType": "git"
            },
            {
              "lessThan": "2884a50f52313a7a911de3afcad065ddbb3d78fc",
              "status": "affected",
              "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd",
              "versionType": "git"
            },
            {
              "lessThan": "e8678551c0243f799b4859448781cbec1bd6f1cb",
              "status": "affected",
              "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd",
              "versionType": "git"
            },
            {
              "lessThan": "4f2bdb3c5e3189297e156b3ff84b140423d64685",
              "status": "affected",
              "version": "dd0b45538146cb6a54d6da7663b8c3afd16ebcfd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "22bc2a4814440c4a8979a381f46fec5d224f5c11",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7cfe824f681e1aaac34ea64bb4def8a77801b672",
              "versionType": "git"
            },
            {
              "lessThan": "4.19.312",
              "status": "affected",
              "version": "4.19.189",
              "versionType": "semver"
            },
            {
              "lessThan": "5.4.274",
              "status": "affected",
              "version": "5.4.114",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.215",
              "status": "affected",
              "version": "5.10.32",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.232",
              "versionType": "semver"
            },
            {
              "lessThan": "5.12",
              "status": "affected",
              "version": "5.11.16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/cfg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.312",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.274",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.215",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.312",
                  "versionStartIncluding": "4.19.189",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.274",
                  "versionStartIncluding": "5.4.114",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.215",
                  "versionStartIncluding": "5.10.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.154",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.84",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.24",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.12",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.3",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.232",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.11.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes\n\nWhen moving a station out of a VLAN and deleting the VLAN afterwards, the\nfast_rx entry still holds a pointer to the VLAN\u0027s netdev, which can cause\nuse-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx\nafter the VLAN change."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The stale `fast_rx-\u003edev` is dereferenced in the 802.11 receive fast path (`ieee80211_rx_8023`) when processing a data frame from the affected station, so the attacker must be an associated WiFi client within radio range of the AP. This is link-local 802.11 reachability, not routable network reach, hence Adjacent.\nAC:L - Once the station has been moved out of a VLAN that is subsequently deleted, every subsequent data frame the attacker transmits deterministically dereferences the freed netdev \u2014 there is no race to win and no memory layout the attacker cannot influence. In a hostapd dynamic-VLAN deployment the attacker induces the move itself by reauthenticating into a different RADIUS-assigned VLAN, and can repeat the sequence at will.\nPR:L - `ieee80211_check_fast_rx` only installs a `fast_rx` entry for a station with `WLAN_STA_AUTHORIZED` and a CCMP/GCMP PTK, so the attacker must be an authenticated, authorized client of the WLAN. That is an ordinary low-privileged network user, not an administrator.\nUI:N - No victim action is needed \u2014 the VLAN reassignment and teardown are performed automatically by hostapd in response to the attacker\u0027s own (re)authentication, and the attacker\u0027s own transmitted frames trigger the dereference.\nS:U - The use-after-free corrupts kernel memory and is exploited within the kernel\u0027s own security authority on the AP; there is no hypervisor, IOMMU, or sandbox boundary crossed.\nC:H - The freed `struct net_device` is read for `-\u003etstats`, `-\u003edev_addr` and `-\u003end_net`, and the skb is delivered into the stack using that stale pointer, so a groomed reclaim yields controlled kernel reads and misdirected traffic delivery; if the slot is reused by a live netdev, the station\u0027s frames leak into a different VLAN, defeating the segmentation the VLAN exists to enforce.\nI:H - `dev_sw_netstats_rx_add(fast_rx-\u003edev, skb-\u003elen)` reads a per-CPU pointer out of the freed object and writes `rx_bytes += skb-\u003elen` (attacker-chosen length) plus `rx_packets++` through it, giving a repeatable, attacker-influenced arbitrary-increment write primitive; combined with the UAF read this is exploitable for control-flow hijacking, and the stale `dev` also permits frame injection into the wrong VLAN.\nA:H - Dereferencing a freed `net_device` from RX softirq context \u2014 including an indirect write through a dangling `-\u003etstats` and passing the freed device to `eth_type_trans`/`netif_receive_skb` \u2014 reliably oopses or panics the access point kernel on the first frame after VLAN teardown."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:56.138Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ea9a0cfc07a7d3601cc680718d9cff0d6927a921"
        },
        {
          "url": "https://git.kernel.org/stable/c/be1dd9254fc115321d6fbee042026d42afc8d931"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8b067c4058c0121ac8ca71559df8e2e08ff1a7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8bddbd91bc8e42c961a5e2cec20ab879f21100f"
        },
        {
          "url": "https://git.kernel.org/stable/c/7eeabcea79b67cc29563e6a9a5c81f9e2c664d5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b948b54c8bd620725e0c906e44b10c0b13087a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/2884a50f52313a7a911de3afcad065ddbb3d78fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8678551c0243f799b4859448781cbec1bd6f1cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f2bdb3c5e3189297e156b3ff84b140423d64685"
        }
      ],
      "title": "wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35789",
    "datePublished": "2024-05-17T12:24:42.323Z",
    "dateReserved": "2024-05-17T12:19:12.338Z",
    "dateUpdated": "2026-10-15T00:40:48.629Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted