CVE-2024-56609 (GCVE-0-2024-56609)
Vulnerability from cvelistv5
Published
2024-12-27 14:51
Modified
2025-05-04 09:59
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb When removing kernel modules by: rmmod rtw88_8723cs rtw88_8703b rtw88_8723x rtw88_sdio rtw88_core Driver uses skb_queue_purge() to purge TX skb, but not report tx status causing "Have pending ack frames!" warning. Use ieee80211_purge_tx_queue() to correct this. Since ieee80211_purge_tx_queue() doesn't take locks, to prevent racing between TX work and purge TX queue, flush and destroy TX work in advance. wlan0: deauthenticating from aa:f5:fd:60:4c:a8 by local choice (Reason: 3=DEAUTH_LEAVING) ------------[ cut here ]------------ Have pending ack frames! WARNING: CPU: 3 PID: 9232 at net/mac80211/main.c:1691 ieee80211_free_ack_frame+0x5c/0x90 [mac80211] CPU: 3 PID: 9232 Comm: rmmod Tainted: G C 6.10.1-200.fc40.aarch64 #1 Hardware name: pine64 Pine64 PinePhone Braveheart (1.1)/Pine64 PinePhone Braveheart (1.1), BIOS 2024.01 01/01/2024 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ieee80211_free_ack_frame+0x5c/0x90 [mac80211] lr : ieee80211_free_ack_frame+0x5c/0x90 [mac80211] sp : ffff80008c1b37b0 x29: ffff80008c1b37b0 x28: ffff000003be8000 x27: 0000000000000000 x26: 0000000000000000 x25: ffff000003dc14b8 x24: ffff80008c1b37d0 x23: ffff000000ff9f80 x22: 0000000000000000 x21: 000000007fffffff x20: ffff80007c7e93d8 x19: ffff00006e66f400 x18: 0000000000000000 x17: ffff7ffffd2b3000 x16: ffff800083fc0000 x15: 0000000000000000 x14: 0000000000000000 x13: 2173656d61726620 x12: 6b636120676e6964 x11: 0000000000000000 x10: 000000000000005d x9 : ffff8000802af2b0 x8 : ffff80008c1b3430 x7 : 0000000000000001 x6 : 0000000000000001 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000003be8000 Call trace: ieee80211_free_ack_frame+0x5c/0x90 [mac80211] idr_for_each+0x74/0x110 ieee80211_free_hw+0x44/0xe8 [mac80211] rtw_sdio_remove+0x9c/0xc0 [rtw88_sdio] sdio_bus_remove+0x44/0x180 device_remove+0x54/0x90 device_release_driver_internal+0x1d4/0x238 driver_detach+0x54/0xc0 bus_remove_driver+0x78/0x108 driver_unregister+0x38/0x78 sdio_unregister_driver+0x2c/0x40 rtw_8723cs_driver_exit+0x18/0x1000 [rtw88_8723cs] __do_sys_delete_module.isra.0+0x190/0x338 __arm64_sys_delete_module+0x1c/0x30 invoke_syscall+0x74/0x100 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x3c/0x158 el0t_64_sync_handler+0x120/0x138 el0t_64_sync+0x194/0x198 ---[ end trace 0000000000000000 ]---
References
Impacted products
Vendor Product Version
Linux Linux Version: e3037485c68ec1a299ff41160d8fedbd4abc29b9
Version: e3037485c68ec1a299ff41160d8fedbd4abc29b9
Version: e3037485c68ec1a299ff41160d8fedbd4abc29b9
Version: e3037485c68ec1a299ff41160d8fedbd4abc29b9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw88/sdio.c",
            "drivers/net/wireless/realtek/rtw88/usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4e8ce3978d704cb28678355d294e10a008b6230a",
              "status": "affected",
              "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9",
              "versionType": "git"
            },
            {
              "lessThan": "3d94c4b21966b49c3e26ceeefacaa11ff7ee6d68",
              "status": "affected",
              "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9",
              "versionType": "git"
            },
            {
              "lessThan": "9bca6528f20325d30c22236b23116f161d418f6d",
              "status": "affected",
              "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9",
              "versionType": "git"
            },
            {
              "lessThan": "3e5e4a801aaf4283390cc34959c6c48f910ca5ea",
              "status": "affected",
              "version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw88/sdio.c",
            "drivers/net/wireless/realtek/rtw88/usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.136",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.70",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb\n\nWhen removing kernel modules by:\n   rmmod rtw88_8723cs rtw88_8703b rtw88_8723x rtw88_sdio rtw88_core\n\nDriver uses skb_queue_purge() to purge TX skb, but not report tx status\ncausing \"Have pending ack frames!\" warning. Use ieee80211_purge_tx_queue()\nto correct this.\n\nSince ieee80211_purge_tx_queue() doesn\u0027t take locks, to prevent racing\nbetween TX work and purge TX queue, flush and destroy TX work in advance.\n\n   wlan0: deauthenticating from aa:f5:fd:60:4c:a8 by local\n     choice (Reason: 3=DEAUTH_LEAVING)\n   ------------[ cut here ]------------\n   Have pending ack frames!\n   WARNING: CPU: 3 PID: 9232 at net/mac80211/main.c:1691\n       ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\n   CPU: 3 PID: 9232 Comm: rmmod Tainted: G         C\n       6.10.1-200.fc40.aarch64 #1\n   Hardware name: pine64 Pine64 PinePhone Braveheart\n      (1.1)/Pine64 PinePhone Braveheart (1.1), BIOS 2024.01 01/01/2024\n   pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n   pc : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\n   lr : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\n   sp : ffff80008c1b37b0\n   x29: ffff80008c1b37b0 x28: ffff000003be8000 x27: 0000000000000000\n   x26: 0000000000000000 x25: ffff000003dc14b8 x24: ffff80008c1b37d0\n   x23: ffff000000ff9f80 x22: 0000000000000000 x21: 000000007fffffff\n   x20: ffff80007c7e93d8 x19: ffff00006e66f400 x18: 0000000000000000\n   x17: ffff7ffffd2b3000 x16: ffff800083fc0000 x15: 0000000000000000\n   x14: 0000000000000000 x13: 2173656d61726620 x12: 6b636120676e6964\n   x11: 0000000000000000 x10: 000000000000005d x9 : ffff8000802af2b0\n   x8 : ffff80008c1b3430 x7 : 0000000000000001 x6 : 0000000000000001\n   x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000\n   x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000003be8000\n   Call trace:\n    ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\n    idr_for_each+0x74/0x110\n    ieee80211_free_hw+0x44/0xe8 [mac80211]\n    rtw_sdio_remove+0x9c/0xc0 [rtw88_sdio]\n    sdio_bus_remove+0x44/0x180\n    device_remove+0x54/0x90\n    device_release_driver_internal+0x1d4/0x238\n    driver_detach+0x54/0xc0\n    bus_remove_driver+0x78/0x108\n    driver_unregister+0x38/0x78\n    sdio_unregister_driver+0x2c/0x40\n    rtw_8723cs_driver_exit+0x18/0x1000 [rtw88_8723cs]\n    __do_sys_delete_module.isra.0+0x190/0x338\n    __arm64_sys_delete_module+0x1c/0x30\n    invoke_syscall+0x74/0x100\n    el0_svc_common.constprop.0+0x48/0xf0\n    do_el0_svc+0x24/0x38\n    el0_svc+0x3c/0x158\n    el0t_64_sync_handler+0x120/0x138\n    el0t_64_sync+0x194/0x198\n   ---[ end trace 0000000000000000 ]---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T09:59:40.547Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4e8ce3978d704cb28678355d294e10a008b6230a"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d94c4b21966b49c3e26ceeefacaa11ff7ee6d68"
        },
        {
          "url": "https://git.kernel.org/stable/c/9bca6528f20325d30c22236b23116f161d418f6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e5e4a801aaf4283390cc34959c6c48f910ca5ea"
        }
      ],
      "title": "wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56609",
    "datePublished": "2024-12-27T14:51:14.155Z",
    "dateReserved": "2024-12-27T14:03:06.013Z",
    "dateUpdated": "2025-05-04T09:59:40.547Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56609\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:20.387\",\"lastModified\":\"2025-05-02T07:15:58.203\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb\\n\\nWhen removing kernel modules by:\\n   rmmod rtw88_8723cs rtw88_8703b rtw88_8723x rtw88_sdio rtw88_core\\n\\nDriver uses skb_queue_purge() to purge TX skb, but not report tx status\\ncausing \\\"Have pending ack frames!\\\" warning. Use ieee80211_purge_tx_queue()\\nto correct this.\\n\\nSince ieee80211_purge_tx_queue() doesn\u0027t take locks, to prevent racing\\nbetween TX work and purge TX queue, flush and destroy TX work in advance.\\n\\n   wlan0: deauthenticating from aa:f5:fd:60:4c:a8 by local\\n     choice (Reason: 3=DEAUTH_LEAVING)\\n   ------------[ cut here ]------------\\n   Have pending ack frames!\\n   WARNING: CPU: 3 PID: 9232 at net/mac80211/main.c:1691\\n       ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\\n   CPU: 3 PID: 9232 Comm: rmmod Tainted: G         C\\n       6.10.1-200.fc40.aarch64 #1\\n   Hardware name: pine64 Pine64 PinePhone Braveheart\\n      (1.1)/Pine64 PinePhone Braveheart (1.1), BIOS 2024.01 01/01/2024\\n   pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\n   pc : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\\n   lr : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\\n   sp : ffff80008c1b37b0\\n   x29: ffff80008c1b37b0 x28: ffff000003be8000 x27: 0000000000000000\\n   x26: 0000000000000000 x25: ffff000003dc14b8 x24: ffff80008c1b37d0\\n   x23: ffff000000ff9f80 x22: 0000000000000000 x21: 000000007fffffff\\n   x20: ffff80007c7e93d8 x19: ffff00006e66f400 x18: 0000000000000000\\n   x17: ffff7ffffd2b3000 x16: ffff800083fc0000 x15: 0000000000000000\\n   x14: 0000000000000000 x13: 2173656d61726620 x12: 6b636120676e6964\\n   x11: 0000000000000000 x10: 000000000000005d x9 : ffff8000802af2b0\\n   x8 : ffff80008c1b3430 x7 : 0000000000000001 x6 : 0000000000000001\\n   x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000\\n   x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000003be8000\\n   Call trace:\\n    ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\\n    idr_for_each+0x74/0x110\\n    ieee80211_free_hw+0x44/0xe8 [mac80211]\\n    rtw_sdio_remove+0x9c/0xc0 [rtw88_sdio]\\n    sdio_bus_remove+0x44/0x180\\n    device_remove+0x54/0x90\\n    device_release_driver_internal+0x1d4/0x238\\n    driver_detach+0x54/0xc0\\n    bus_remove_driver+0x78/0x108\\n    driver_unregister+0x38/0x78\\n    sdio_unregister_driver+0x2c/0x40\\n    rtw_8723cs_driver_exit+0x18/0x1000 [rtw88_8723cs]\\n    __do_sys_delete_module.isra.0+0x190/0x338\\n    __arm64_sys_delete_module+0x1c/0x30\\n    invoke_syscall+0x74/0x100\\n    el0_svc_common.constprop.0+0x48/0xf0\\n    do_el0_svc+0x24/0x38\\n    el0_svc+0x3c/0x158\\n    el0t_64_sync_handler+0x120/0x138\\n    el0t_64_sync+0x194/0x198\\n   ---[ end trace 0000000000000000 ]---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: rtw88: use ieee80211_purge_tx_queue() para purgar TX skb Al eliminar m\u00f3dulos del kernel mediante: rmmod rtw88_8723cs rtw88_8703b rtw88_8723x rtw88_sdio rtw88_core El controlador usa skb_queue_purge() para purgar TX skb, pero no informa el estado de la tx, lo que provoca la advertencia \\\"\u00a1Tiene marcos de reconocimiento pendientes!\\\". Use ieee80211_purge_tx_queue() para corregir esto. Dado que ieee80211_purge_tx_queue() no toma bloqueos, para evitar ejecuci\u00f3ns entre el trabajo de TX y la cola de purga de TX, vac\u00ede y destruya el trabajo de TX con anticipaci\u00f3n. wlan0: desautenticando desde aa:f5:fd:60:4c:a8 por elecci\u00f3n local (Raz\u00f3n: 3=DEAUTH_LEAVING) ------------[ cortar aqu\u00ed ]------------ \u00a1Hay marcos de reconocimiento pendientes! ADVERTENCIA: CPU: 3 PID: 9232 en net/mac80211/main.c:1691 ieee80211_free_ack_frame+0x5c/0x90 [mac80211] CPU: 3 PID: 9232 Comm: rmmod Contaminado: GC 6.10.1-200.fc40.aarch64 #1 Nombre del hardware: pine64 Pine64 PinePhone Braveheart (1.1)/Pine64 PinePhone Braveheart (1.1), BIOS 2024.01 01/01/2024 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ieee80211_free_ack_frame+0x5c/0x90 [mac80211] lr : ieee80211_free_ack_frame+0x5c/0x90 [mac80211] sp : ffff80008c1b37b0 x29: ffff80008c1b37b0 x28: ffff000003be8000 x27: 0000000000000000 x26: 0000000000000000 x25: ffff000003dc14b8 x24: ffff80008c1b37d0 x23: ffff000000ff9f80 x22: 0000000000000000 x21: 000000007fffffff x20: ffff80007c7e93d8 x19: ffff00006e66f400 x18: 0000000000000000 x17: ffff7ffffd2b3000 x16: ffff800083fc0000 x15: 0000000000000000 x14: 0000000000000000 x13: 2173656d61726620 x12: 6b636120676e6964 x11: 000000000000000 x10: 000000000000005d x9: ffff8000802af2b0 x8: ffff80008c1b3430 x7: 00000000000000001 x6 : 0000000000000001 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000003be8000 Rastreo de llamadas: ieee80211_free_ack_frame+0x5c/0x90 [mac80211] idr_for_each+0x74/0x110 ieee80211_free_hw+0x44/0xe8 [mac80211] rtw_sdio_remove+0x9c/0xc0 [rtw88_sdio] sdio_bus_remove+0x44/0x180 device_remove+0x54/0x90 device_release_driver_internal+0x1d4/0x238 driver_detach+0x54/0xc0 bus_remove_driver+0x78/0x108 driver_unregister+0x38/0x78 sdio_unregister_driver+0x2c/0x40 rtw_8723cs_driver_exit+0x18/0x1000 [rtw88_8723cs] __do_sys_delete_module.isra.0+0x190/0x338 __arm64_sys_delete_module+0x1c/0x30 invocar_llamada_al_sistema+0x74/0x100 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x3c/0x158 el0t_64_sync_handler+0x120/0x138 el0t_64_sync+0x194/0x198 ---[ fin de seguimiento 0000000000000000 ]---\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3d94c4b21966b49c3e26ceeefacaa11ff7ee6d68\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3e5e4a801aaf4283390cc34959c6c48f910ca5ea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4e8ce3978d704cb28678355d294e10a008b6230a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9bca6528f20325d30c22236b23116f161d418f6d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.