CVE-2024-47712

wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param

MEDIUM
5.5
CVSS Score
Published: October 21, 2024 at 11:53 AM UTC
Updated: August 5, 2026 at 12:04 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.4%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param In the `wilc_parse_join_bss_param` function, the TSF field of the `ies` structure is accessed after the RCU read-side critical section is unlocked. According to RCU usage rules, this is illegal. Reusing this pointer can lead to unpredictable behavior, including accessing memory that has been updated or causing use-after-free issues. This possible bug was identified using a static analysis tool developed by myself, specifically designed to detect RCU-related issues. To address this, the TSF value is now stored in a local variable `ies_tsf` before the RCU lock is released. The `param->tsf_lo` field is then assigned using this local variable, ensuring that the TSF value is safely accessed.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v ≥ 6.7.11v ≥ 6.8.25.10.214 ≤ v < 5.10.2275.15.153 ≤ v < 5.15.1685.4.273 ≤ v < 5.4.2855.4.273 ≤ v < 5.56.1.83 ≤ v < 6.1.1136.11 ≤ v < 6.11.26.6.23 ≤ v < 6.6.546.7.11 ≤ v < 6.86.8.2 ≤ v < 6.96.9 ≤ v < 6.10.136.9 ≤ v < 6.11.26.9 ≤ v < 6.126.9 < v < 6.10.13205c50306acf58a335eb19fa84e40140f4fe814f4bfd20d5f5c62b5495d6c0016ee6933bd3add7ce5.10.2145.15.1535.4.2735800ec78775c0cd646f71eb9bf8402fb794807de6.1.836.6.236.7.116.8.26.9745003b5917b610352f52fe0d11ef658d6471ec2b4bbf38c350acb6500cbe667b1e2e68f896e4b38d80fc436751cfa6b02a8eda74eb6cce7dadfe5a2dd50d3ead6e3707bb0a5df7cc832730c93ace3a7e556006de4ea93abe2b46cba202a2556c544b8b2
Vendor states this is fixed in 2f944e6255c2fc1c9bd9ee32f6b14ee0b2a51eb5 (fixed)
Vendor states this is fixed in 557418e1704605a81c9e26732449f71b1d40ba1e (fixed)
Vendor states this is fixed in 5a24cedc243ace5ed7c1016f52a7bfc8f5b07815 (fixed)
Vendor states this is fixed in 6d7c6ae1efb1ff68bc01d79d94fdf0388f86cdd8 (fixed)
Vendor states this is fixed in 79510414a7626317f13cc9073244ab7a8deb3192 (fixed)
Vendor states this is fixed in 84398204c5df5aaf89453056cf0647cda9664d2b (fixed)
Vendor states this is fixed in b040b71d99ee5e17bb7a743dc01cbfcae8908ce1 (fixed)
Vendor states this is fixed in bf090f4fe935294361eabd9dc5a949fdd77d3d1b (fixed)
Vendor states this is fixed in 5.10.227 (unaffected)
Vendor states this is fixed in 5.15.168 (unaffected)
Vendor states this is fixed in 5.4.285 (unaffected)
Affected range stops below 5.5, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 6.1.113 (unaffected)
Vendor states this is fixed in 6.10.13 (unaffected)
Vendor states this is fixed in 6.11.2 (unaffected)
Vendor states this is fixed in 6.12 (unaffected)
Vendor states this is fixed in 6.6.54 (unaffected)
Affected range stops below 6.8, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 6.9 (unaffected)

References (10)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/2f944e6255c2fc1c9bd9ee32f6b14ee0b2a51eb5
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/557418e1704605a81c9e26732449f71b1d40ba1e
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/6d7c6ae1efb1ff68bc01d79d94fdf0388f86cdd8
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/79510414a7626317f13cc9073244ab7a8deb3192
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/84398204c5df5aaf89453056cf0647cda9664d2b
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b040b71d99ee5e17bb7a743dc01cbfcae8908ce1
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/bf090f4fe935294361eabd9dc5a949fdd77d3d1b

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card