GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-40929 (GCVE-0-2024-40929)

Vulnerability from cvelistv5 – Published: 2024-07-12 12:25 – Updated: 2026-08-05 11:34
VLAI
Title
wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: check n_ssids before accessing the ssids In some versions of cfg80211, the ssids poinet might be a valid one even though n_ssids is 0. Accessing the pointer in this case will cuase an out-of-bound access. Fix this by checking n_ssids first.
Severity
7.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 17:05 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c1a7515393e403758a684fd0a2372af466675b15 , < 3c4771091ea8016c8601399078916f722dd8833b (git)
Affected: c1a7515393e403758a684fd0a2372af466675b15 , < f777792952d03bbaf8329fdfa99393a5a33e2640 (git)
Affected: c1a7515393e403758a684fd0a2372af466675b15 , < 9e719ae3abad60e245ce248ba3f08148f375a614 (git)
Affected: c1a7515393e403758a684fd0a2372af466675b15 , < 29a18d56bd64b95bd10bda4afda512558471382a (git)
Affected: c1a7515393e403758a684fd0a2372af466675b15 , < 62e007bdeb91c6879a4652c3426aef1cd9d2937b (git)
Affected: c1a7515393e403758a684fd0a2372af466675b15 , < 60d62757df30b74bf397a2847a6db7385c6ee281 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 5.10.221 , ≤ 5.10.* (semver)
Unaffected: 5.15.162 , ≤ 5.15.* (semver)
Unaffected: 6.1.95 , ≤ 6.1.* (semver)
Unaffected: 6.6.35 , ≤ 6.6.* (semver)
Unaffected: 6.9.6 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:57:56.614Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3c4771091ea8016c8601399078916f722dd8833b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f777792952d03bbaf8329fdfa99393a5a33e2640"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9e719ae3abad60e245ce248ba3f08148f375a614"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/29a18d56bd64b95bd10bda4afda512558471382a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/62e007bdeb91c6879a4652c3426aef1cd9d2937b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/60d62757df30b74bf397a2847a6db7385c6ee281"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40929",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:05:05.324309Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:02.938Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/mvm/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3c4771091ea8016c8601399078916f722dd8833b",
              "status": "affected",
              "version": "c1a7515393e403758a684fd0a2372af466675b15",
              "versionType": "git"
            },
            {
              "lessThan": "f777792952d03bbaf8329fdfa99393a5a33e2640",
              "status": "affected",
              "version": "c1a7515393e403758a684fd0a2372af466675b15",
              "versionType": "git"
            },
            {
              "lessThan": "9e719ae3abad60e245ce248ba3f08148f375a614",
              "status": "affected",
              "version": "c1a7515393e403758a684fd0a2372af466675b15",
              "versionType": "git"
            },
            {
              "lessThan": "29a18d56bd64b95bd10bda4afda512558471382a",
              "status": "affected",
              "version": "c1a7515393e403758a684fd0a2372af466675b15",
              "versionType": "git"
            },
            {
              "lessThan": "62e007bdeb91c6879a4652c3426aef1cd9d2937b",
              "status": "affected",
              "version": "c1a7515393e403758a684fd0a2372af466675b15",
              "versionType": "git"
            },
            {
              "lessThan": "60d62757df30b74bf397a2847a6db7385c6ee281",
              "status": "affected",
              "version": "c1a7515393e403758a684fd0a2372af466675b15",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/mvm/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.221",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.162",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.95",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.35",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.6",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: check n_ssids before accessing the ssids\n\nIn some versions of cfg80211, the ssids poinet might be a valid one even\nthough n_ssids is 0. Accessing the pointer in this case will cuase an\nout-of-bound access. Fix this by checking n_ssids first."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable branch is only reached through cfg80211\u0027s split 6 GHz scan, whose request layout and channel count are built from co-located-AP (RNR) information carried in beacons/probe responses received over the air, so an attacker within WiFi radio range shapes the allocation that is read out of bounds. Per WiFi-frame guidance this is Adjacent rather than Local.\nAC:L - The attacker can beacon crafted RNR elements continuously and vary the advertised co-located-AP count to sweep allocation layouts, while 6 GHz-capable iwlwifi clients perform passive scans routinely, so the condition can be retried until it hits.\nPR:N - An adjacent attacker needs no account or credentials on the target; the passive 6 GHz scan that walks the buggy code is initiated automatically by the system\u0027s normal background scanning rather than by any attacker-held privilege.\nUI:N - Periodic passive scanning by NetworkManager/wpa_supplicant drives the vulnerable path with no action from the logged-in user.\nS:U - The out-of-bounds read stays inside the kernel\u0027s own memory and security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:L - The read is a single byte at a fixed offset 32 past the ssids pointer and is never copied to userspace or the air; it only selects between two hard-coded dwell budgets (100 vs 300 TU), which yields at most a timing-observable one-bit oracle on adjacent kernel heap memory.\nI:N - Nothing is written out of bounds \u2014 the only side effect is that one of two legitimate constant values is placed in the firmware scan command\u0027s adwell_max_budget field.\nA:H - The access reads up to 33 bytes past the end of a kzalloc\u0027d scan request; on KASAN or hardened kernels this is a slab-out-of-bounds report that panics under panic_on_warn/kasan.fault=panic, and a page-order allocation ending on a page boundary can fault and oops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:34:05.245Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3c4771091ea8016c8601399078916f722dd8833b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f777792952d03bbaf8329fdfa99393a5a33e2640"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e719ae3abad60e245ce248ba3f08148f375a614"
        },
        {
          "url": "https://git.kernel.org/stable/c/29a18d56bd64b95bd10bda4afda512558471382a"
        },
        {
          "url": "https://git.kernel.org/stable/c/62e007bdeb91c6879a4652c3426aef1cd9d2937b"
        },
        {
          "url": "https://git.kernel.org/stable/c/60d62757df30b74bf397a2847a6db7385c6ee281"
        }
      ],
      "title": "wifi: iwlwifi: mvm: check n_ssids before accessing the ssids",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40929",
    "datePublished": "2024-07-12T12:25:08.434Z",
    "dateReserved": "2024-07-12T12:17:45.583Z",
    "dateUpdated": "2026-08-05T11:34:05.245Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-40929",
      "date": "2026-09-16",
      "epss": "0.00364",
      "percentile": "0.29965"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: iwlwifi: mvm: check n_ssids before accessing the ssids\\n\\nIn some versions of cfg80211, the ssids poinet might be a valid one even\\nthough n_ssids is 0. Accessing the pointer in this case will cuase an\\nout-of-bound access. Fix this by checking n_ssids first.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: iwlwifi: mvm: verifique n_ssids antes de acceder a los ssids en algunas versiones de cfg80211, el punto ssids puede ser v\\u00e1lido aunque n_ssids sea 0. Accediendo al puntero en este caso provocar\\u00e1 un acceso fuera de los l\\u00edmites. Solucione este problema comprobando primero n_ssids.\"}]",
      "id": "CVE-2024-40929",
      "lastModified": "2024-11-21T09:31:53.453",
      "published": "2024-07-12T13:15:15.610",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/29a18d56bd64b95bd10bda4afda512558471382a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/3c4771091ea8016c8601399078916f722dd8833b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/60d62757df30b74bf397a2847a6db7385c6ee281\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/62e007bdeb91c6879a4652c3426aef1cd9d2937b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9e719ae3abad60e245ce248ba3f08148f375a614\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f777792952d03bbaf8329fdfa99393a5a33e2640\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/29a18d56bd64b95bd10bda4afda512558471382a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/3c4771091ea8016c8601399078916f722dd8833b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/60d62757df30b74bf397a2847a6db7385c6ee281\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/62e007bdeb91c6879a4652c3426aef1cd9d2937b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/9e719ae3abad60e245ce248ba3f08148f375a614\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/f777792952d03bbaf8329fdfa99393a5a33e2640\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-40929\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-12T13:15:15.610\",\"lastModified\":\"2026-08-04T11:19:06.587\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: iwlwifi: mvm: check n_ssids before accessing the ssids\\n\\nIn some versions of cfg80211, the ssids poinet might be a valid one even\\nthough n_ssids is 0. Accessing the pointer in this case will cuase an\\nout-of-bound access. Fix this by checking n_ssids first.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: iwlwifi: mvm: verifique n_ssids antes de acceder a los ssids en algunas versiones de cfg80211, el punto ssids puede ser v\u00e1lido aunque n_ssids sea 0. Accediendo al puntero en este caso provocar\u00e1 un acceso fuera de los l\u00edmites. Solucione este problema comprobando primero n_ssids.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/intel/iwlwifi/mvm/scan.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c1a7515393e403758a684fd0a2372af466675b15\",\"lessThan\":\"3c4771091ea8016c8601399078916f722dd8833b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c1a7515393e403758a684fd0a2372af466675b15\",\"lessThan\":\"f777792952d03bbaf8329fdfa99393a5a33e2640\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c1a7515393e403758a684fd0a2372af466675b15\",\"lessThan\":\"9e719ae3abad60e245ce248ba3f08148f375a614\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c1a7515393e403758a684fd0a2372af466675b15\",\"lessThan\":\"29a18d56bd64b95bd10bda4afda512558471382a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c1a7515393e403758a684fd0a2372af466675b15\",\"lessThan\":\"62e007bdeb91c6879a4652c3426aef1cd9d2937b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c1a7515393e403758a684fd0a2372af466675b15\",\"lessThan\":\"60d62757df30b74bf397a2847a6db7385c6ee281\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/intel/iwlwifi/mvm/scan.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.221\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.162\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.95\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.35\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.6\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":4.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:05:05.324309Z\",\"id\":\"CVE-2024-40929\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.17\",\"versionEndExcluding\":\"5.10.221\",\"matchCriteriaId\":\"DD9AD5B5-3984-4237-A53B-E65C3B56EF3E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.162\",\"matchCriteriaId\":\"10A39ACC-3005-40E8-875C-98A372D1FFD5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.95\",\"matchCriteriaId\":\"D435765D-2766-44F5-B319-F713A13E35CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.35\",\"matchCriteriaId\":\"6F019D15-84C0-416B-8C57-7F51B68992F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.6\",\"matchCriteriaId\":\"0ABBBA1D-F79D-4BDB-AA41-D1EDCC4A6975\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"331C2F14-12C7-45D5-893D-8C52EE38EA10\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/29a18d56bd64b95bd10bda4afda512558471382a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3c4771091ea8016c8601399078916f722dd8833b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/60d62757df30b74bf397a2847a6db7385c6ee281\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/62e007bdeb91c6879a4652c3426aef1cd9d2937b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9e719ae3abad60e245ce248ba3f08148f375a614\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f777792952d03bbaf8329fdfa99393a5a33e2640\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/29a18d56bd64b95bd10bda4afda512558471382a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3c4771091ea8016c8601399078916f722dd8833b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/60d62757df30b74bf397a2847a6db7385c6ee281\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/62e007bdeb91c6879a4652c3426aef1cd9d2937b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9e719ae3abad60e245ce248ba3f08148f375a614\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f777792952d03bbaf8329fdfa99393a5a33e2640\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:44:51+00:00",
      "cve": "CVE-2024-40929",
      "id": "CVE-2024-40929",
      "initial_release_date": "2024-07-12T00:00:00+00:00",
      "product_status:fixed": "429",
      "product_status:known_affected": "50",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: iwlwifi: mvm: check n_ssids before accessing the ssids",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-40929.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:23:14Z",
      "cve": "CVE-2024-40929",
      "id": "CVE-2024-40929",
      "initial_release_date": "2024-07-16T02:34:42Z",
      "product_status:known_affected": "572",
      "product_status:known_not_affected": "14",
      "product_status:recommended": "772",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-40929",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-40929.json",
      "version": "95"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3c4771091ea8016c8601399078916f722dd8833b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f777792952d03bbaf8329fdfa99393a5a33e2640\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9e719ae3abad60e245ce248ba3f08148f375a614\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/29a18d56bd64b95bd10bda4afda512558471382a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/62e007bdeb91c6879a4652c3426aef1cd9d2937b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/60d62757df30b74bf397a2847a6db7385c6ee281\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:39:55.376Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-40929\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:05:05.324309Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:14.230Z\"}}], \"cna\": {\"title\": \"wifi: iwlwifi: mvm: check n_ssids before accessing the ssids\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c1a7515393e403758a684fd0a2372af466675b15\", \"lessThan\": \"3c4771091ea8016c8601399078916f722dd8833b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c1a7515393e403758a684fd0a2372af466675b15\", \"lessThan\": \"f777792952d03bbaf8329fdfa99393a5a33e2640\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c1a7515393e403758a684fd0a2372af466675b15\", \"lessThan\": \"9e719ae3abad60e245ce248ba3f08148f375a614\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c1a7515393e403758a684fd0a2372af466675b15\", \"lessThan\": \"29a18d56bd64b95bd10bda4afda512558471382a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c1a7515393e403758a684fd0a2372af466675b15\", \"lessThan\": \"62e007bdeb91c6879a4652c3426aef1cd9d2937b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c1a7515393e403758a684fd0a2372af466675b15\", \"lessThan\": \"60d62757df30b74bf397a2847a6db7385c6ee281\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/wireless/intel/iwlwifi/mvm/scan.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.17\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.221\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.162\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.95\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.35\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/wireless/intel/iwlwifi/mvm/scan.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3c4771091ea8016c8601399078916f722dd8833b\"}, {\"url\": \"https://git.kernel.org/stable/c/f777792952d03bbaf8329fdfa99393a5a33e2640\"}, {\"url\": \"https://git.kernel.org/stable/c/9e719ae3abad60e245ce248ba3f08148f375a614\"}, {\"url\": \"https://git.kernel.org/stable/c/29a18d56bd64b95bd10bda4afda512558471382a\"}, {\"url\": \"https://git.kernel.org/stable/c/62e007bdeb91c6879a4652c3426aef1cd9d2937b\"}, {\"url\": \"https://git.kernel.org/stable/c/60d62757df30b74bf397a2847a6db7385c6ee281\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: iwlwifi: mvm: check n_ssids before accessing the ssids\\n\\nIn some versions of cfg80211, the ssids poinet might be a valid one even\\nthough n_ssids is 0. Accessing the pointer in this case will cuase an\\nout-of-bound access. Fix this by checking n_ssids first.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.221\", \"versionStartIncluding\": \"4.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.162\", \"versionStartIncluding\": \"4.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.95\", \"versionStartIncluding\": \"4.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.35\", \"versionStartIncluding\": \"4.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.6\", \"versionStartIncluding\": \"4.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"4.17\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:18:04.282Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-40929\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:18:04.282Z\", \"dateReserved\": \"2024-07-12T12:17:45.583Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-12T12:25:08.434Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.