CVE-2024-53156— wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-53156
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() I found the following bug in my fuzzer: UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51 index 255 is out of range for type 'htc_endpoint [22]' CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.11.0-rc6-dirty #14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: events request_firmware_work_func Call Trace: <TASK> dump_stack_lvl+0x180/0x1b0 __ubsan_handle_out_of_bounds+0xd4/0x130 htc_issue_send.constprop.0+0x20c/0x230 ? _raw_spin_unlock_irqrestore+0x3c/0x70 ath9k_wmi_cmd+0x41d/0x610 ? mark_held_locks+0x9f/0xe0 ... Since this bug has been confirmed to be caused by insufficient verification of conn_rsp_epid, I think it would be appropriate to add a range check for conn_rsp_epid to htc_connect_service() to prevent the bug from occurring.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于wifi驱动ath9k中htc_connect_service函数对conn_rsp_epid缺少范围检查。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-53156
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-53156
请登录查看更多情报信息。
Same Patch Batch · Linux · 2024-12-24 · 20 CVEs total
| CVE-2024-53152 | PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert() | |
| CVE-2024-53163 | crypto: qat/qat_420xx - fix off by one in uof_get_name() | |
| CVE-2024-53162 | crypto: qat/qat_4xxx - fix off by one in uof_get_name() | |
| CVE-2024-53161 | EDAC/bluefield: Fix potential integer overflow | |
| CVE-2024-53160 | rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu | |
| CVE-2024-53158 | soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() | |
| CVE-2024-53157 | firmware: arm_scpi: Check the DVFS OPP count returned by the firmware | |
| CVE-2024-53155 | ocfs2: fix uninitialized value in ocfs2_file_read_iter() | |
| CVE-2024-53154 | clk: clk-apple-nco: Add NULL check in applnco_probe | |
| CVE-2024-53153 | PCI: qcom-ep: Move controller cleanups to qcom_pcie_perst_deassert() | |
| CVE-2024-53240 | xen/netfront: fix crash when removing device | |
| CVE-2024-53151 | svcrdma: Address an integer overflow | |
| CVE-2024-53150 | ALSA: usb-audio: Fix out of bounds reads when finding clock sources | |
| CVE-2024-53149 | usb: typec: ucsi: glink: fix off-by-one in connector_status | |
| CVE-2024-53148 | comedi: Flush partial mappings in error case | |
| CVE-2024-53147 | exfat: fix out-of-bounds access of directory entries | |
| CVE-2024-53146 | NFSD: Prevent a potential integer overflow | |
| CVE-2024-53145 | um: Fix potential integer overflow during physmem setup | |
| CVE-2024-53241 | x86/xen: don't do PV iret hypercall through hypercall page |
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
Same vendor: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. Comments for CVE-2024-53156
No comments yet