CVE-2024-46755 (GCVE-0-2024-46755)
Vulnerability from cvelistv5 – Published: 2024-09-18 07:12 – Updated: 2026-08-05 11:38
VLAI
EPSS
VEX
Title
wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
mwifiex_get_priv_by_id() returns the priv pointer corresponding to
the bss_num and bss_type, but without checking if the priv is actually
currently in use.
Unused priv pointers do not have a wiphy attached to them which can
lead to NULL pointer dereferences further down the callstack. Fix
this by returning only used priv pointers which have priv->bss_mode
set to something else than NL80211_IFTYPE_UNSPECIFIED.
Said NULL pointer dereference happened when an Accesspoint was started
with wpa_supplicant -i mlan0 with this config:
network={
ssid="somessid"
mode=2
frequency=2412
key_mgmt=WPA-PSK WPA-PSK-SHA256
proto=RSN
group=CCMP
pairwise=CCMP
psk="12345678"
}
When waiting for the AP to be established, interrupting wpa_supplicant
with <ctrl-c> and starting it again this happens:
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000140
| Mem abort info:
| ESR = 0x0000000096000004
| EC = 0x25: DABT (current EL), IL = 32 bits
| SET = 0, FnV = 0
| EA = 0, S1PTW = 0
| FSC = 0x04: level 0 translation fault
| Data abort info:
| ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
| CM = 0, WnR = 0, TnD = 0, TagAccess = 0
| GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
| user pgtable: 4k pages, 48-bit VAs, pgdp=0000000046d96000
| [0000000000000140] pgd=0000000000000000, p4d=0000000000000000
| Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
| Modules linked in: caam_jr caamhash_desc spidev caamalg_desc crypto_engine authenc libdes mwifiex_sdio
+mwifiex crct10dif_ce cdc_acm onboard_usb_hub fsl_imx8_ddr_perf imx8m_ddrc rtc_ds1307 lm75 rtc_snvs
+imx_sdma caam imx8mm_thermal spi_imx error imx_cpufreq_dt fuse ip_tables x_tables ipv6
| CPU: 0 PID: 8 Comm: kworker/0:1 Not tainted 6.9.0-00007-g937242013fce-dirty #18
| Hardware name: somemachine (DT)
| Workqueue: events sdio_irq_work
| pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
| pc : mwifiex_get_cfp+0xd8/0x15c [mwifiex]
| lr : mwifiex_get_cfp+0x34/0x15c [mwifiex]
| sp : ffff8000818b3a70
| x29: ffff8000818b3a70 x28: ffff000006bfd8a5 x27: 0000000000000004
| x26: 000000000000002c x25: 0000000000001511 x24: 0000000002e86bc9
| x23: ffff000006bfd996 x22: 0000000000000004 x21: ffff000007bec000
| x20: 000000000000002c x19: 0000000000000000 x18: 0000000000000000
| x17: 000000040044ffff x16: 00500072b5503510 x15: ccc283740681e517
| x14: 0201000101006d15 x13: 0000000002e8ff43 x12: 002c01000000ffb1
| x11: 0100000000000000 x10: 02e8ff43002c0100 x9 : 0000ffb100100157
| x8 : ffff000003d20000 x7 : 00000000000002f1 x6 : 00000000ffffe124
| x5 : 0000000000000001 x4 : 0000000000000003 x3 : 0000000000000000
| x2 : 0000000000000000 x1 : 0001000000011001 x0 : 0000000000000000
| Call trace:
| mwifiex_get_cfp+0xd8/0x15c [mwifiex]
| mwifiex_parse_single_response_buf+0x1d0/0x504 [mwifiex]
| mwifiex_handle_event_ext_scan_report+0x19c/0x2f8 [mwifiex]
| mwifiex_process_sta_event+0x298/0xf0c [mwifiex]
| mwifiex_process_event+0x110/0x238 [mwifiex]
| mwifiex_main_process+0x428/0xa44 [mwifiex]
| mwifiex_sdio_interrupt+0x64/0x12c [mwifiex_sdio]
| process_sdio_pending_irqs+0x64/0x1b8
| sdio_irq_work+0x4c/0x7c
| process_one_work+0x148/0x2a0
| worker_thread+0x2fc/0x40c
| kthread+0x110/0x114
| ret_from_fork+0x10/0x20
| Code: a94153f3 a8c37bfd d50323bf d65f03c0 (f940a000)
| ---[ end trace 0000000000000000 ]---
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-29 14:46 UTC
Assigner
References
10 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
93a1df48d224296fb527d32fbec4d5162828feb4 , < a12cf97cbefa139ef8d95081f2ea047cbbd74b7a
(git)
Affected: 93a1df48d224296fb527d32fbec4d5162828feb4 , < d834433ff313838a259bb6607055ece87b895b66 (git) Affected: 93a1df48d224296fb527d32fbec4d5162828feb4 , < 9813770f25855b866b8ead8155b8806b2db70f6d (git) Affected: 93a1df48d224296fb527d32fbec4d5162828feb4 , < cb67b2e51b75f1a17bee7599c8161b96e1808a70 (git) Affected: 93a1df48d224296fb527d32fbec4d5162828feb4 , < 1a05d8d02cfa3540ea5dbd6b39446bd3f515521f (git) Affected: 93a1df48d224296fb527d32fbec4d5162828feb4 , < c2618dcb26c7211342b54520b5b148c0d3471c8a (git) Affected: 93a1df48d224296fb527d32fbec4d5162828feb4 , < c16916dd6c16fa7e13ca3923eb6b9f50d848ad03 (git) Affected: 93a1df48d224296fb527d32fbec4d5162828feb4 , < c145eea2f75ff7949392aebecf7ef0a81c1f6c14 (git) |
guessed | |
| Linux | Linux |
Affected:
3.2
Unaffected: 0 , < 3.2 (semver) Unaffected: 4.19.322 , ≤ 4.19.* (semver) Unaffected: 5.4.284 , ≤ 5.4.* (semver) Unaffected: 5.10.226 , ≤ 5.10.* (semver) Unaffected: 5.15.167 , ≤ 5.15.* (semver) Unaffected: 6.1.110 , ≤ 6.1.* (semver) Unaffected: 6.6.51 , ≤ 6.6.* (semver) Unaffected: 6.10.10 , ≤ 6.10.* (semver) Unaffected: 6.11 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-46755",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-29T14:46:11.339320Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-29T15:51:59.794Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:17:50.652Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/mwifiex/main.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a12cf97cbefa139ef8d95081f2ea047cbbd74b7a",
"status": "affected",
"version": "93a1df48d224296fb527d32fbec4d5162828feb4",
"versionType": "git"
},
{
"lessThan": "d834433ff313838a259bb6607055ece87b895b66",
"status": "affected",
"version": "93a1df48d224296fb527d32fbec4d5162828feb4",
"versionType": "git"
},
{
"lessThan": "9813770f25855b866b8ead8155b8806b2db70f6d",
"status": "affected",
"version": "93a1df48d224296fb527d32fbec4d5162828feb4",
"versionType": "git"
},
{
"lessThan": "cb67b2e51b75f1a17bee7599c8161b96e1808a70",
"status": "affected",
"version": "93a1df48d224296fb527d32fbec4d5162828feb4",
"versionType": "git"
},
{
"lessThan": "1a05d8d02cfa3540ea5dbd6b39446bd3f515521f",
"status": "affected",
"version": "93a1df48d224296fb527d32fbec4d5162828feb4",
"versionType": "git"
},
{
"lessThan": "c2618dcb26c7211342b54520b5b148c0d3471c8a",
"status": "affected",
"version": "93a1df48d224296fb527d32fbec4d5162828feb4",
"versionType": "git"
},
{
"lessThan": "c16916dd6c16fa7e13ca3923eb6b9f50d848ad03",
"status": "affected",
"version": "93a1df48d224296fb527d32fbec4d5162828feb4",
"versionType": "git"
},
{
"lessThan": "c145eea2f75ff7949392aebecf7ef0a81c1f6c14",
"status": "affected",
"version": "93a1df48d224296fb527d32fbec4d5162828feb4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/mwifiex/main.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.322",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.284",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.226",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.10.*",
"status": "unaffected",
"version": "6.10.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.11",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.322",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.284",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.226",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.167",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.110",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.51",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.10.10",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.11",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()\n\nmwifiex_get_priv_by_id() returns the priv pointer corresponding to\nthe bss_num and bss_type, but without checking if the priv is actually\ncurrently in use.\nUnused priv pointers do not have a wiphy attached to them which can\nlead to NULL pointer dereferences further down the callstack. Fix\nthis by returning only used priv pointers which have priv-\u003ebss_mode\nset to something else than NL80211_IFTYPE_UNSPECIFIED.\n\nSaid NULL pointer dereference happened when an Accesspoint was started\nwith wpa_supplicant -i mlan0 with this config:\n\nnetwork={\n ssid=\"somessid\"\n mode=2\n frequency=2412\n key_mgmt=WPA-PSK WPA-PSK-SHA256\n proto=RSN\n group=CCMP\n pairwise=CCMP\n psk=\"12345678\"\n}\n\nWhen waiting for the AP to be established, interrupting wpa_supplicant\nwith \u003cctrl-c\u003e and starting it again this happens:\n\n| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000140\n| Mem abort info:\n| ESR = 0x0000000096000004\n| EC = 0x25: DABT (current EL), IL = 32 bits\n| SET = 0, FnV = 0\n| EA = 0, S1PTW = 0\n| FSC = 0x04: level 0 translation fault\n| Data abort info:\n| ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n| CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n| GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n| user pgtable: 4k pages, 48-bit VAs, pgdp=0000000046d96000\n| [0000000000000140] pgd=0000000000000000, p4d=0000000000000000\n| Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\n| Modules linked in: caam_jr caamhash_desc spidev caamalg_desc crypto_engine authenc libdes mwifiex_sdio\n+mwifiex crct10dif_ce cdc_acm onboard_usb_hub fsl_imx8_ddr_perf imx8m_ddrc rtc_ds1307 lm75 rtc_snvs\n+imx_sdma caam imx8mm_thermal spi_imx error imx_cpufreq_dt fuse ip_tables x_tables ipv6\n| CPU: 0 PID: 8 Comm: kworker/0:1 Not tainted 6.9.0-00007-g937242013fce-dirty #18\n| Hardware name: somemachine (DT)\n| Workqueue: events sdio_irq_work\n| pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n| pc : mwifiex_get_cfp+0xd8/0x15c [mwifiex]\n| lr : mwifiex_get_cfp+0x34/0x15c [mwifiex]\n| sp : ffff8000818b3a70\n| x29: ffff8000818b3a70 x28: ffff000006bfd8a5 x27: 0000000000000004\n| x26: 000000000000002c x25: 0000000000001511 x24: 0000000002e86bc9\n| x23: ffff000006bfd996 x22: 0000000000000004 x21: ffff000007bec000\n| x20: 000000000000002c x19: 0000000000000000 x18: 0000000000000000\n| x17: 000000040044ffff x16: 00500072b5503510 x15: ccc283740681e517\n| x14: 0201000101006d15 x13: 0000000002e8ff43 x12: 002c01000000ffb1\n| x11: 0100000000000000 x10: 02e8ff43002c0100 x9 : 0000ffb100100157\n| x8 : ffff000003d20000 x7 : 00000000000002f1 x6 : 00000000ffffe124\n| x5 : 0000000000000001 x4 : 0000000000000003 x3 : 0000000000000000\n| x2 : 0000000000000000 x1 : 0001000000011001 x0 : 0000000000000000\n| Call trace:\n| mwifiex_get_cfp+0xd8/0x15c [mwifiex]\n| mwifiex_parse_single_response_buf+0x1d0/0x504 [mwifiex]\n| mwifiex_handle_event_ext_scan_report+0x19c/0x2f8 [mwifiex]\n| mwifiex_process_sta_event+0x298/0xf0c [mwifiex]\n| mwifiex_process_event+0x110/0x238 [mwifiex]\n| mwifiex_main_process+0x428/0xa44 [mwifiex]\n| mwifiex_sdio_interrupt+0x64/0x12c [mwifiex_sdio]\n| process_sdio_pending_irqs+0x64/0x1b8\n| sdio_irq_work+0x4c/0x7c\n| process_one_work+0x148/0x2a0\n| worker_thread+0x2fc/0x40c\n| kthread+0x110/0x114\n| ret_from_fork+0x10/0x20\n| Code: a94153f3 a8c37bfd d50323bf d65f03c0 (f940a000)\n| ---[ end trace 0000000000000000 ]---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable dispatch is driven by data arriving from the wireless medium \u2014 ext-scan-report events generated from nearby beacons/probe responses and RX data frames whose RXPD `bss_num`/`bss_type` select the priv \u2014 so an attacker within 802.11 range of the mwifiex device supplies the triggering input. This matches the adjacent-network treatment used for other frame-driven mwifiex/mac80211 defects.\nAC:L - No race must be won: the zero-initialized decoy privs permanently shadow `(bss_num 0, bss_type STA)` on any device operating in AP/hotspot mode, and privs left behind by `mwifiex_del_virtual_intf()` keep matching their old BSS id indefinitely, so a steady stream of frames/events reliably lands on an unused priv.\nPR:N - The attacker needs no credentials or association on the target \u2014 unassociated beacons/probe responses feed the scan-result event path and received frames feed the RX data path, both of which are processed before any authentication state matters.\nUI:N - No victim action is required; the stale-priv condition is the device\u0027s steady-state configuration in AP/hotspot deployments and after any routine interface teardown, and the driver processes the offending events and frames autonomously in a workqueue/IRQ context.\nS:U - Both the flawed lookup and its consequences are confined to the kernel\u0027s own security authority within the mwifiex driver; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - A stale priv causes reads through dangling and never-initialized pointers, and on a deleted interface the freed `priv-\u003ehist_data` object continues to be accessed (including read back via the debugfs histogram after reallocation), giving disclosure of reused heap contents; per use-after-free treatment this is High.\nI:H - `mwifiex_hist_data_add()`/`mwifiex_hist_data_set()` perform `atomic_inc()` into the freed `hist_data` buffer at offsets derived from the received frame\u0027s `rx_rate`/`snr`/`nf` fields (with `rssi = snr - nflr` able to index past the arrays), yielding an out-of-bounds write primitive on freed heap memory that is exploitable for control-flow influence.\nA:H - The commit documents a reproducible kernel oops \u2014 NULL dereference of `priv-\u003ewdev.wiphy-\u003ebands[]` in `mwifiex_get_cfp()` \u2014 and the same stale priv also NULL-derefs `priv-\u003enetdev` in `eth_type_trans()`, producing a kernel panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:38:23.495Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a12cf97cbefa139ef8d95081f2ea047cbbd74b7a"
},
{
"url": "https://git.kernel.org/stable/c/d834433ff313838a259bb6607055ece87b895b66"
},
{
"url": "https://git.kernel.org/stable/c/9813770f25855b866b8ead8155b8806b2db70f6d"
},
{
"url": "https://git.kernel.org/stable/c/cb67b2e51b75f1a17bee7599c8161b96e1808a70"
},
{
"url": "https://git.kernel.org/stable/c/1a05d8d02cfa3540ea5dbd6b39446bd3f515521f"
},
{
"url": "https://git.kernel.org/stable/c/c2618dcb26c7211342b54520b5b148c0d3471c8a"
},
{
"url": "https://git.kernel.org/stable/c/c16916dd6c16fa7e13ca3923eb6b9f50d848ad03"
},
{
"url": "https://git.kernel.org/stable/c/c145eea2f75ff7949392aebecf7ef0a81c1f6c14"
}
],
"title": "wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-46755",
"datePublished": "2024-09-18T07:12:14.820Z",
"dateReserved": "2024-09-11T15:12:18.270Z",
"dateUpdated": "2026-08-05T11:38:23.495Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-46755",
"date": "2026-09-16",
"epss": "0.00398",
"percentile": "0.33555"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"4.19.322\", \"matchCriteriaId\": \"29162FB8-5FA4-4DC4-86CE-5EB0CAEEF2F3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.20\", \"versionEndExcluding\": \"5.4.284\", \"matchCriteriaId\": \"6265A402-9C3C-438F-BFC5-4194B2568B85\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.226\", \"matchCriteriaId\": \"864FC17C-501A-4823-A643-6F35D65D8A97\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.167\", \"matchCriteriaId\": \"043405A4-25FE-45D4-A7BB-2A0C3B7D17C1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.110\", \"matchCriteriaId\": \"6B1A95FC-7E7E-428B-BB59-F76640C652AE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.51\", \"matchCriteriaId\": \"E4529134-BAC4-4776-840B-304009E181A0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.10\", \"matchCriteriaId\": \"ACDEE48C-137A-4731-90D0-A675865E1BED\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()\\n\\nmwifiex_get_priv_by_id() returns the priv pointer corresponding to\\nthe bss_num and bss_type, but without checking if the priv is actually\\ncurrently in use.\\nUnused priv pointers do not have a wiphy attached to them which can\\nlead to NULL pointer dereferences further down the callstack. Fix\\nthis by returning only used priv pointers which have priv-\u003ebss_mode\\nset to something else than NL80211_IFTYPE_UNSPECIFIED.\\n\\nSaid NULL pointer dereference happened when an Accesspoint was started\\nwith wpa_supplicant -i mlan0 with this config:\\n\\nnetwork={\\n ssid=\\\"somessid\\\"\\n mode=2\\n frequency=2412\\n key_mgmt=WPA-PSK WPA-PSK-SHA256\\n proto=RSN\\n group=CCMP\\n pairwise=CCMP\\n psk=\\\"12345678\\\"\\n}\\n\\nWhen waiting for the AP to be established, interrupting wpa_supplicant\\nwith \u003cctrl-c\u003e and starting it again this happens:\\n\\n| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000140\\n| Mem abort info:\\n| ESR = 0x0000000096000004\\n| EC = 0x25: DABT (current EL), IL = 32 bits\\n| SET = 0, FnV = 0\\n| EA = 0, S1PTW = 0\\n| FSC = 0x04: level 0 translation fault\\n| Data abort info:\\n| ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\\n| CM = 0, WnR = 0, TnD = 0, TagAccess = 0\\n| GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\\n| user pgtable: 4k pages, 48-bit VAs, pgdp=0000000046d96000\\n| [0000000000000140] pgd=0000000000000000, p4d=0000000000000000\\n| Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\\n| Modules linked in: caam_jr caamhash_desc spidev caamalg_desc crypto_engine authenc libdes mwifiex_sdio\\n+mwifiex crct10dif_ce cdc_acm onboard_usb_hub fsl_imx8_ddr_perf imx8m_ddrc rtc_ds1307 lm75 rtc_snvs\\n+imx_sdma caam imx8mm_thermal spi_imx error imx_cpufreq_dt fuse ip_tables x_tables ipv6\\n| CPU: 0 PID: 8 Comm: kworker/0:1 Not tainted 6.9.0-00007-g937242013fce-dirty #18\\n| Hardware name: somemachine (DT)\\n| Workqueue: events sdio_irq_work\\n| pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\n| pc : mwifiex_get_cfp+0xd8/0x15c [mwifiex]\\n| lr : mwifiex_get_cfp+0x34/0x15c [mwifiex]\\n| sp : ffff8000818b3a70\\n| x29: ffff8000818b3a70 x28: ffff000006bfd8a5 x27: 0000000000000004\\n| x26: 000000000000002c x25: 0000000000001511 x24: 0000000002e86bc9\\n| x23: ffff000006bfd996 x22: 0000000000000004 x21: ffff000007bec000\\n| x20: 000000000000002c x19: 0000000000000000 x18: 0000000000000000\\n| x17: 000000040044ffff x16: 00500072b5503510 x15: ccc283740681e517\\n| x14: 0201000101006d15 x13: 0000000002e8ff43 x12: 002c01000000ffb1\\n| x11: 0100000000000000 x10: 02e8ff43002c0100 x9 : 0000ffb100100157\\n| x8 : ffff000003d20000 x7 : 00000000000002f1 x6 : 00000000ffffe124\\n| x5 : 0000000000000001 x4 : 0000000000000003 x3 : 0000000000000000\\n| x2 : 0000000000000000 x1 : 0001000000011001 x0 : 0000000000000000\\n| Call trace:\\n| mwifiex_get_cfp+0xd8/0x15c [mwifiex]\\n| mwifiex_parse_single_response_buf+0x1d0/0x504 [mwifiex]\\n| mwifiex_handle_event_ext_scan_report+0x19c/0x2f8 [mwifiex]\\n| mwifiex_process_sta_event+0x298/0xf0c [mwifiex]\\n| mwifiex_process_event+0x110/0x238 [mwifiex]\\n| mwifiex_main_process+0x428/0xa44 [mwifiex]\\n| mwifiex_sdio_interrupt+0x64/0x12c [mwifiex_sdio]\\n| process_sdio_pending_irqs+0x64/0x1b8\\n| sdio_irq_work+0x4c/0x7c\\n| process_one_work+0x148/0x2a0\\n| worker_thread+0x2fc/0x40c\\n| kthread+0x110/0x114\\n| ret_from_fork+0x10/0x20\\n| Code: a94153f3 a8c37bfd d50323bf d65f03c0 (f940a000)\\n| ---[ end trace 0000000000000000 ]---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mwifiex: No devolver priv sin usar en mwifiex_get_priv_by_id() mwifiex_get_priv_by_id() devuelve el puntero priv correspondiente a bss_num y bss_type, pero sin comprobar si el priv est\\u00e1 realmente en uso actualmente. Los punteros priv sin usar no tienen un wiphy adjunto a ellos, lo que puede provocar desreferencias de puntero NULL m\\u00e1s abajo en la pila de llamadas. Solucione esto devolviendo solo punteros priv usados que tengan priv-\u0026gt;bss_mode establecido en algo distinto de NL80211_IFTYPE_UNSPECIFIED. Dicha desreferencia de puntero NULL ocurri\\u00f3 cuando un Accesspoint fue iniciado con wpa_supplicant -i mlan0 con esta configuraci\\u00f3n: network={ ssid=\\\"somessid\\\" mode=2 frequency=2412 key_mgmt=WPA-PSK WPA-PSK-SHA256 proto=RSN group=CCMP pairwise=CCMP psk=\\\"12345678\\\" } Al esperar a que se establezca el AP, interrumpiendo wpa_supplicant con y reinici\\u00e1ndolo esto sucede: | No se puede manejar la desreferencia de puntero NULL del kernel en la direcci\\u00f3n virtual 0000000000000140 | Informaci\\u00f3n de aborto de memoria: | ESR = 0x0000000096000004 | EC = 0x25: DABT (EL actual), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: error de traducci\\u00f3n de nivel 0 | Informaci\\u00f3n de cancelaci\\u00f3n de datos: | ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 | CM = 0, WnR = 0, TnD = 0, TagAccess = 0 | GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 | pgtable del usuario: p\\u00e1ginas de 4k, VA de 48 bits, pgdp=0000000046d96000 | [0000000000000140] pgd=000000000000000, p4d=0000000000000000 | Error interno: Oops: 0000000096000004 [#1] PREEMPT SMP | M\\u00f3dulos vinculados en: caam_jr caamhash_desc spidev caamalg_desc crypto_engine authenc libdes mwifiex_sdio +mwifiex crct10dif_ce cdc_acm onboard_usb_hub fsl_imx8_ddr_perf imx8m_ddrc rtc_ds1307 lm75 rtc_snvs +imx_sdma caam imx8mm_thermal spi_imx error imx_cpufreq_dt fuse ip_tables x_tables ipv6 | CPU: 0 PID: 8 Comm: kworker/0:1 No contaminado 6.9.0-00007-g937242013fce-dirty #18 | Nombre del hardware: somemachine (DT) | Cola de trabajo: eventos sdio_irq_work | pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : mwifiex_get_cfp+0xd8/0x15c [mwifiex] | lr : mwifiex_get_cfp+0x34/0x15c [mwifiex] | sp : ffff8000818b3a70 | x29: ffff8000818b3a70 x28: ffff000006bfd8a5 x27: 0000000000000004 | x26: 000000000000002c x25: 00000000000001511 x24: 00000000002e86bc9 | x23: ffff000006bfd996 x22: 0000000000000004 x21: ffff000007bec000 | x20: 000000000000002c x19: 0000000000000000 x18: 0000000000000000 | x17: 000000040044ffff x16: 00500072b5503510 x15: ccc283740681e517 | x14: 0201000101006d15 x13: 0000000002e8ff43 x12: 002c0100000ffb1 | x11: 0100000000000000 x10: 02e8ff43002c0100 x9: 0000ffb100100157 | x8: ffff000003d20000 x7: 00000000000002f1 x6: 00000000ffffe124 | x5 : 0000000000000001 x4 : 0000000000000003 x3 : 0000000000000000 | x2 : 0000000000000000 x1 : 0001000000011001 x0 : 0000000000000000 | Rastreo de llamadas: | mwifiex_get_cfp+0xd8/0x15c [mwifiex] | mwifiex_parse_single_response_buf+0x1d0/0x504 [mwifiex] | mwifiex_handle_event_ext_scan_report+0x19c/0x2f8 [mwifiex] | mwifiex_process_sta_event+0x298/0xf0c [mwifiex] | mwifiex_process_event+0x110/0x238 [mwifiex] | mwifiex_main_process+0x428/0xa44 [mwifiex] | mwifiex_sdio_interrupt+0x64/0x12c [mwifiex_sdio] | proceso_sdio_pending_irqs+0x64/0x1b8 | sdio_irq_work+0x4c/0x7c | proceso_one_work+0x148/0x2a0 | subproceso_trabajador+0x2fc/0x40c | kthread+0x110/0x114 | ret_from_fork+0x10/0x20 | C\\u00f3digo: a94153f3 a8c37bfd d50323bf d65f03c0 (f940a000) | ---[ fin del seguimiento 0000000000000000 ]---\"}]",
"id": "CVE-2024-46755",
"lastModified": "2024-09-26T13:25:54.593",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
"published": "2024-09-18T08:15:04.203",
"references": "[{\"url\": \"https://git.kernel.org/stable/c/1a05d8d02cfa3540ea5dbd6b39446bd3f515521f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9813770f25855b866b8ead8155b8806b2db70f6d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a12cf97cbefa139ef8d95081f2ea047cbbd74b7a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c145eea2f75ff7949392aebecf7ef0a81c1f6c14\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c16916dd6c16fa7e13ca3923eb6b9f50d848ad03\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c2618dcb26c7211342b54520b5b148c0d3471c8a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/cb67b2e51b75f1a17bee7599c8161b96e1808a70\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d834433ff313838a259bb6607055ece87b895b66\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Analyzed",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-46755\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-18T08:15:04.203\",\"lastModified\":\"2026-08-04T11:20:22.560\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()\\n\\nmwifiex_get_priv_by_id() returns the priv pointer corresponding to\\nthe bss_num and bss_type, but without checking if the priv is actually\\ncurrently in use.\\nUnused priv pointers do not have a wiphy attached to them which can\\nlead to NULL pointer dereferences further down the callstack. Fix\\nthis by returning only used priv pointers which have priv-\u003ebss_mode\\nset to something else than NL80211_IFTYPE_UNSPECIFIED.\\n\\nSaid NULL pointer dereference happened when an Accesspoint was started\\nwith wpa_supplicant -i mlan0 with this config:\\n\\nnetwork={\\n ssid=\\\"somessid\\\"\\n mode=2\\n frequency=2412\\n key_mgmt=WPA-PSK WPA-PSK-SHA256\\n proto=RSN\\n group=CCMP\\n pairwise=CCMP\\n psk=\\\"12345678\\\"\\n}\\n\\nWhen waiting for the AP to be established, interrupting wpa_supplicant\\nwith \u003cctrl-c\u003e and starting it again this happens:\\n\\n| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000140\\n| Mem abort info:\\n| ESR = 0x0000000096000004\\n| EC = 0x25: DABT (current EL), IL = 32 bits\\n| SET = 0, FnV = 0\\n| EA = 0, S1PTW = 0\\n| FSC = 0x04: level 0 translation fault\\n| Data abort info:\\n| ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\\n| CM = 0, WnR = 0, TnD = 0, TagAccess = 0\\n| GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\\n| user pgtable: 4k pages, 48-bit VAs, pgdp=0000000046d96000\\n| [0000000000000140] pgd=0000000000000000, p4d=0000000000000000\\n| Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\\n| Modules linked in: caam_jr caamhash_desc spidev caamalg_desc crypto_engine authenc libdes mwifiex_sdio\\n+mwifiex crct10dif_ce cdc_acm onboard_usb_hub fsl_imx8_ddr_perf imx8m_ddrc rtc_ds1307 lm75 rtc_snvs\\n+imx_sdma caam imx8mm_thermal spi_imx error imx_cpufreq_dt fuse ip_tables x_tables ipv6\\n| CPU: 0 PID: 8 Comm: kworker/0:1 Not tainted 6.9.0-00007-g937242013fce-dirty #18\\n| Hardware name: somemachine (DT)\\n| Workqueue: events sdio_irq_work\\n| pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\n| pc : mwifiex_get_cfp+0xd8/0x15c [mwifiex]\\n| lr : mwifiex_get_cfp+0x34/0x15c [mwifiex]\\n| sp : ffff8000818b3a70\\n| x29: ffff8000818b3a70 x28: ffff000006bfd8a5 x27: 0000000000000004\\n| x26: 000000000000002c x25: 0000000000001511 x24: 0000000002e86bc9\\n| x23: ffff000006bfd996 x22: 0000000000000004 x21: ffff000007bec000\\n| x20: 000000000000002c x19: 0000000000000000 x18: 0000000000000000\\n| x17: 000000040044ffff x16: 00500072b5503510 x15: ccc283740681e517\\n| x14: 0201000101006d15 x13: 0000000002e8ff43 x12: 002c01000000ffb1\\n| x11: 0100000000000000 x10: 02e8ff43002c0100 x9 : 0000ffb100100157\\n| x8 : ffff000003d20000 x7 : 00000000000002f1 x6 : 00000000ffffe124\\n| x5 : 0000000000000001 x4 : 0000000000000003 x3 : 0000000000000000\\n| x2 : 0000000000000000 x1 : 0001000000011001 x0 : 0000000000000000\\n| Call trace:\\n| mwifiex_get_cfp+0xd8/0x15c [mwifiex]\\n| mwifiex_parse_single_response_buf+0x1d0/0x504 [mwifiex]\\n| mwifiex_handle_event_ext_scan_report+0x19c/0x2f8 [mwifiex]\\n| mwifiex_process_sta_event+0x298/0xf0c [mwifiex]\\n| mwifiex_process_event+0x110/0x238 [mwifiex]\\n| mwifiex_main_process+0x428/0xa44 [mwifiex]\\n| mwifiex_sdio_interrupt+0x64/0x12c [mwifiex_sdio]\\n| process_sdio_pending_irqs+0x64/0x1b8\\n| sdio_irq_work+0x4c/0x7c\\n| process_one_work+0x148/0x2a0\\n| worker_thread+0x2fc/0x40c\\n| kthread+0x110/0x114\\n| ret_from_fork+0x10/0x20\\n| Code: a94153f3 a8c37bfd d50323bf d65f03c0 (f940a000)\\n| ---[ end trace 0000000000000000 ]---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mwifiex: No devolver priv sin usar en mwifiex_get_priv_by_id() mwifiex_get_priv_by_id() devuelve el puntero priv correspondiente a bss_num y bss_type, pero sin comprobar si el priv est\u00e1 realmente en uso actualmente. Los punteros priv sin usar no tienen un wiphy adjunto a ellos, lo que puede provocar desreferencias de puntero NULL m\u00e1s abajo en la pila de llamadas. Solucione esto devolviendo solo punteros priv usados que tengan priv-\u0026gt;bss_mode establecido en algo distinto de NL80211_IFTYPE_UNSPECIFIED. Dicha desreferencia de puntero NULL ocurri\u00f3 cuando un Accesspoint fue iniciado con wpa_supplicant -i mlan0 con esta configuraci\u00f3n: network={ ssid=\\\"somessid\\\" mode=2 frequency=2412 key_mgmt=WPA-PSK WPA-PSK-SHA256 proto=RSN group=CCMP pairwise=CCMP psk=\\\"12345678\\\" } Al esperar a que se establezca el AP, interrumpiendo wpa_supplicant con y reinici\u00e1ndolo esto sucede: | No se puede manejar la desreferencia de puntero NULL del kernel en la direcci\u00f3n virtual 0000000000000140 | Informaci\u00f3n de aborto de memoria: | ESR = 0x0000000096000004 | EC = 0x25: DABT (EL actual), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: error de traducci\u00f3n de nivel 0 | Informaci\u00f3n de cancelaci\u00f3n de datos: | ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 | CM = 0, WnR = 0, TnD = 0, TagAccess = 0 | GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 | pgtable del usuario: p\u00e1ginas de 4k, VA de 48 bits, pgdp=0000000046d96000 | [0000000000000140] pgd=000000000000000, p4d=0000000000000000 | Error interno: Oops: 0000000096000004 [#1] PREEMPT SMP | M\u00f3dulos vinculados en: caam_jr caamhash_desc spidev caamalg_desc crypto_engine authenc libdes mwifiex_sdio +mwifiex crct10dif_ce cdc_acm onboard_usb_hub fsl_imx8_ddr_perf imx8m_ddrc rtc_ds1307 lm75 rtc_snvs +imx_sdma caam imx8mm_thermal spi_imx error imx_cpufreq_dt fuse ip_tables x_tables ipv6 | CPU: 0 PID: 8 Comm: kworker/0:1 No contaminado 6.9.0-00007-g937242013fce-dirty #18 | Nombre del hardware: somemachine (DT) | Cola de trabajo: eventos sdio_irq_work | pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : mwifiex_get_cfp+0xd8/0x15c [mwifiex] | lr : mwifiex_get_cfp+0x34/0x15c [mwifiex] | sp : ffff8000818b3a70 | x29: ffff8000818b3a70 x28: ffff000006bfd8a5 x27: 0000000000000004 | x26: 000000000000002c x25: 00000000000001511 x24: 00000000002e86bc9 | x23: ffff000006bfd996 x22: 0000000000000004 x21: ffff000007bec000 | x20: 000000000000002c x19: 0000000000000000 x18: 0000000000000000 | x17: 000000040044ffff x16: 00500072b5503510 x15: ccc283740681e517 | x14: 0201000101006d15 x13: 0000000002e8ff43 x12: 002c0100000ffb1 | x11: 0100000000000000 x10: 02e8ff43002c0100 x9: 0000ffb100100157 | x8: ffff000003d20000 x7: 00000000000002f1 x6: 00000000ffffe124 | x5 : 0000000000000001 x4 : 0000000000000003 x3 : 0000000000000000 | x2 : 0000000000000000 x1 : 0001000000011001 x0 : 0000000000000000 | Rastreo de llamadas: | mwifiex_get_cfp+0xd8/0x15c [mwifiex] | mwifiex_parse_single_response_buf+0x1d0/0x504 [mwifiex] | mwifiex_handle_event_ext_scan_report+0x19c/0x2f8 [mwifiex] | mwifiex_process_sta_event+0x298/0xf0c [mwifiex] | mwifiex_process_event+0x110/0x238 [mwifiex] | mwifiex_main_process+0x428/0xa44 [mwifiex] | mwifiex_sdio_interrupt+0x64/0x12c [mwifiex_sdio] | proceso_sdio_pending_irqs+0x64/0x1b8 | sdio_irq_work+0x4c/0x7c | proceso_one_work+0x148/0x2a0 | subproceso_trabajador+0x2fc/0x40c | kthread+0x110/0x114 | ret_from_fork+0x10/0x20 | C\u00f3digo: a94153f3 a8c37bfd d50323bf d65f03c0 (f940a000) | ---[ fin del seguimiento 0000000000000000 ]---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/marvell/mwifiex/main.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"93a1df48d224296fb527d32fbec4d5162828feb4\",\"lessThan\":\"a12cf97cbefa139ef8d95081f2ea047cbbd74b7a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"93a1df48d224296fb527d32fbec4d5162828feb4\",\"lessThan\":\"d834433ff313838a259bb6607055ece87b895b66\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"93a1df48d224296fb527d32fbec4d5162828feb4\",\"lessThan\":\"9813770f25855b866b8ead8155b8806b2db70f6d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"93a1df48d224296fb527d32fbec4d5162828feb4\",\"lessThan\":\"cb67b2e51b75f1a17bee7599c8161b96e1808a70\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"93a1df48d224296fb527d32fbec4d5162828feb4\",\"lessThan\":\"1a05d8d02cfa3540ea5dbd6b39446bd3f515521f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"93a1df48d224296fb527d32fbec4d5162828feb4\",\"lessThan\":\"c2618dcb26c7211342b54520b5b148c0d3471c8a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"93a1df48d224296fb527d32fbec4d5162828feb4\",\"lessThan\":\"c16916dd6c16fa7e13ca3923eb6b9f50d848ad03\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"93a1df48d224296fb527d32fbec4d5162828feb4\",\"lessThan\":\"c145eea2f75ff7949392aebecf7ef0a81c1f6c14\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/marvell/mwifiex/main.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.322\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.284\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.226\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.167\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.110\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.51\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.10\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-29T14:46:11.339320Z\",\"id\":\"CVE-2024-46755\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.19.322\",\"matchCriteriaId\":\"29162FB8-5FA4-4DC4-86CE-5EB0CAEEF2F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.284\",\"matchCriteriaId\":\"6265A402-9C3C-438F-BFC5-4194B2568B85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.226\",\"matchCriteriaId\":\"864FC17C-501A-4823-A643-6F35D65D8A97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.167\",\"matchCriteriaId\":\"043405A4-25FE-45D4-A7BB-2A0C3B7D17C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.110\",\"matchCriteriaId\":\"6B1A95FC-7E7E-428B-BB59-F76640C652AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.51\",\"matchCriteriaId\":\"E4529134-BAC4-4776-840B-304009E181A0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.10\",\"matchCriteriaId\":\"ACDEE48C-137A-4731-90D0-A675865E1BED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1a05d8d02cfa3540ea5dbd6b39446bd3f515521f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9813770f25855b866b8ead8155b8806b2db70f6d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a12cf97cbefa139ef8d95081f2ea047cbbd74b7a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c145eea2f75ff7949392aebecf7ef0a81c1f6c14\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c16916dd6c16fa7e13ca3923eb6b9f50d848ad03\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c2618dcb26c7211342b54520b5b148c0d3471c8a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cb67b2e51b75f1a17bee7599c8161b96e1808a70\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d834433ff313838a259bb6607055ece87b895b66\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-09-13T09:11:33+00:00",
"cve": "CVE-2024-46755",
"id": "CVE-2024-46755",
"initial_release_date": "2024-09-18T00:00:00+00:00",
"product_status:known_affected": "198",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46755.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-08-29T01:48:19Z",
"cve": "CVE-2024-46755",
"id": "CVE-2024-46755",
"initial_release_date": "2024-09-19T03:10:31Z",
"product_status:known_affected": "642",
"product_status:known_not_affected": "12",
"product_status:recommended": "680",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2024-46755",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-46755.json",
"version": "84"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:17:50.652Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46755\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T14:46:11.339320Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T15:51:56.719Z\"}}], \"cna\": {\"title\": \"wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"93a1df48d224296fb527d32fbec4d5162828feb4\", \"lessThan\": \"a12cf97cbefa139ef8d95081f2ea047cbbd74b7a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"93a1df48d224296fb527d32fbec4d5162828feb4\", \"lessThan\": \"d834433ff313838a259bb6607055ece87b895b66\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"93a1df48d224296fb527d32fbec4d5162828feb4\", \"lessThan\": \"9813770f25855b866b8ead8155b8806b2db70f6d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"93a1df48d224296fb527d32fbec4d5162828feb4\", \"lessThan\": \"cb67b2e51b75f1a17bee7599c8161b96e1808a70\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"93a1df48d224296fb527d32fbec4d5162828feb4\", \"lessThan\": \"1a05d8d02cfa3540ea5dbd6b39446bd3f515521f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"93a1df48d224296fb527d32fbec4d5162828feb4\", \"lessThan\": \"c2618dcb26c7211342b54520b5b148c0d3471c8a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"93a1df48d224296fb527d32fbec4d5162828feb4\", \"lessThan\": \"c16916dd6c16fa7e13ca3923eb6b9f50d848ad03\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"93a1df48d224296fb527d32fbec4d5162828feb4\", \"lessThan\": \"c145eea2f75ff7949392aebecf7ef0a81c1f6c14\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/wireless/marvell/mwifiex/main.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.322\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.284\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.226\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.167\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.110\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.51\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/wireless/marvell/mwifiex/main.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/a12cf97cbefa139ef8d95081f2ea047cbbd74b7a\"}, {\"url\": \"https://git.kernel.org/stable/c/d834433ff313838a259bb6607055ece87b895b66\"}, {\"url\": \"https://git.kernel.org/stable/c/9813770f25855b866b8ead8155b8806b2db70f6d\"}, {\"url\": \"https://git.kernel.org/stable/c/cb67b2e51b75f1a17bee7599c8161b96e1808a70\"}, {\"url\": \"https://git.kernel.org/stable/c/1a05d8d02cfa3540ea5dbd6b39446bd3f515521f\"}, {\"url\": \"https://git.kernel.org/stable/c/c2618dcb26c7211342b54520b5b148c0d3471c8a\"}, {\"url\": \"https://git.kernel.org/stable/c/c16916dd6c16fa7e13ca3923eb6b9f50d848ad03\"}, {\"url\": \"https://git.kernel.org/stable/c/c145eea2f75ff7949392aebecf7ef0a81c1f6c14\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()\\n\\nmwifiex_get_priv_by_id() returns the priv pointer corresponding to\\nthe bss_num and bss_type, but without checking if the priv is actually\\ncurrently in use.\\nUnused priv pointers do not have a wiphy attached to them which can\\nlead to NULL pointer dereferences further down the callstack. Fix\\nthis by returning only used priv pointers which have priv-\u003ebss_mode\\nset to something else than NL80211_IFTYPE_UNSPECIFIED.\\n\\nSaid NULL pointer dereference happened when an Accesspoint was started\\nwith wpa_supplicant -i mlan0 with this config:\\n\\nnetwork={\\n ssid=\\\"somessid\\\"\\n mode=2\\n frequency=2412\\n key_mgmt=WPA-PSK WPA-PSK-SHA256\\n proto=RSN\\n group=CCMP\\n pairwise=CCMP\\n psk=\\\"12345678\\\"\\n}\\n\\nWhen waiting for the AP to be established, interrupting wpa_supplicant\\nwith \u003cctrl-c\u003e and starting it again this happens:\\n\\n| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000140\\n| Mem abort info:\\n| ESR = 0x0000000096000004\\n| EC = 0x25: DABT (current EL), IL = 32 bits\\n| SET = 0, FnV = 0\\n| EA = 0, S1PTW = 0\\n| FSC = 0x04: level 0 translation fault\\n| Data abort info:\\n| ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\\n| CM = 0, WnR = 0, TnD = 0, TagAccess = 0\\n| GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\\n| user pgtable: 4k pages, 48-bit VAs, pgdp=0000000046d96000\\n| [0000000000000140] pgd=0000000000000000, p4d=0000000000000000\\n| Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\\n| Modules linked in: caam_jr caamhash_desc spidev caamalg_desc crypto_engine authenc libdes mwifiex_sdio\\n+mwifiex crct10dif_ce cdc_acm onboard_usb_hub fsl_imx8_ddr_perf imx8m_ddrc rtc_ds1307 lm75 rtc_snvs\\n+imx_sdma caam imx8mm_thermal spi_imx error imx_cpufreq_dt fuse ip_tables x_tables ipv6\\n| CPU: 0 PID: 8 Comm: kworker/0:1 Not tainted 6.9.0-00007-g937242013fce-dirty #18\\n| Hardware name: somemachine (DT)\\n| Workqueue: events sdio_irq_work\\n| pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\n| pc : mwifiex_get_cfp+0xd8/0x15c [mwifiex]\\n| lr : mwifiex_get_cfp+0x34/0x15c [mwifiex]\\n| sp : ffff8000818b3a70\\n| x29: ffff8000818b3a70 x28: ffff000006bfd8a5 x27: 0000000000000004\\n| x26: 000000000000002c x25: 0000000000001511 x24: 0000000002e86bc9\\n| x23: ffff000006bfd996 x22: 0000000000000004 x21: ffff000007bec000\\n| x20: 000000000000002c x19: 0000000000000000 x18: 0000000000000000\\n| x17: 000000040044ffff x16: 00500072b5503510 x15: ccc283740681e517\\n| x14: 0201000101006d15 x13: 0000000002e8ff43 x12: 002c01000000ffb1\\n| x11: 0100000000000000 x10: 02e8ff43002c0100 x9 : 0000ffb100100157\\n| x8 : ffff000003d20000 x7 : 00000000000002f1 x6 : 00000000ffffe124\\n| x5 : 0000000000000001 x4 : 0000000000000003 x3 : 0000000000000000\\n| x2 : 0000000000000000 x1 : 0001000000011001 x0 : 0000000000000000\\n| Call trace:\\n| mwifiex_get_cfp+0xd8/0x15c [mwifiex]\\n| mwifiex_parse_single_response_buf+0x1d0/0x504 [mwifiex]\\n| mwifiex_handle_event_ext_scan_report+0x19c/0x2f8 [mwifiex]\\n| mwifiex_process_sta_event+0x298/0xf0c [mwifiex]\\n| mwifiex_process_event+0x110/0x238 [mwifiex]\\n| mwifiex_main_process+0x428/0xa44 [mwifiex]\\n| mwifiex_sdio_interrupt+0x64/0x12c [mwifiex_sdio]\\n| process_sdio_pending_irqs+0x64/0x1b8\\n| sdio_irq_work+0x4c/0x7c\\n| process_one_work+0x148/0x2a0\\n| worker_thread+0x2fc/0x40c\\n| kthread+0x110/0x114\\n| ret_from_fork+0x10/0x20\\n| Code: a94153f3 a8c37bfd d50323bf d65f03c0 (f940a000)\\n| ---[ end trace 0000000000000000 ]---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.322\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.284\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.226\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.167\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.110\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.51\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.10\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"3.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-01-05T10:53:11.877Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-46755\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-05T10:53:11.877Z\", \"dateReserved\": \"2024-09-11T15:12:18.270Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-18T07:12:14.820Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…