CVE-2024-26683
Vulnerability from cvelistv5
Published
2024-04-02 07:01
Modified
2024-12-19 08:44
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: detect stuck ECSA element in probe resp We recently added some validation that we don't try to connect to an AP that is currently in a channel switch process, since that might want the channel to be quiet or we might not be able to connect in time to hear the switching in a beacon. This was in commit c09c4f31998b ("wifi: mac80211: don't connect to an AP while it's in a CSA process"). However, we promptly got a report that this caused new connection failures, and it turns out that the AP that we now cannot connect to is permanently advertising an extended channel switch announcement, even with quiet. The AP in question was an Asus RT-AC53, with firmware 3.0.0.4.380_10760-g21a5898. As a first step, attempt to detect that we're dealing with such a situation, so mac80211 can use this later.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/177fbbcb4ed6b306c1626a277fac3fb1c495a4c7
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ce112c941c2b172afba3e913a90c380647d53975
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/177fbbcb4ed6b306c1626a277fac3fb1c495a4c7
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/ce112c941c2b172afba3e913a90c380647d53975
Impacted products
Vendor Product Version
Linux Linux Version: 6.7
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26683",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-03T15:15:07.235616Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:48:53.665Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:12.754Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ce112c941c2b172afba3e913a90c380647d53975"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/177fbbcb4ed6b306c1626a277fac3fb1c495a4c7"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/cfg80211.h",
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ce112c941c2b172afba3e913a90c380647d53975",
              "status": "affected",
              "version": "c09c4f31998bac6d73508e38812518aceb069b68",
              "versionType": "git"
            },
            {
              "lessThan": "177fbbcb4ed6b306c1626a277fac3fb1c495a4c7",
              "status": "affected",
              "version": "c09c4f31998bac6d73508e38812518aceb069b68",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/cfg80211.h",
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: detect stuck ECSA element in probe resp\n\nWe recently added some validation that we don\u0027t try to\nconnect to an AP that is currently in a channel switch\nprocess, since that might want the channel to be quiet\nor we might not be able to connect in time to hear the\nswitching in a beacon. This was in commit c09c4f31998b\n(\"wifi: mac80211: don\u0027t connect to an AP while it\u0027s in\na CSA process\").\n\nHowever, we promptly got a report that this caused new\nconnection failures, and it turns out that the AP that\nwe now cannot connect to is permanently advertising an\nextended channel switch announcement, even with quiet.\nThe AP in question was an Asus RT-AC53, with firmware\n3.0.0.4.380_10760-g21a5898.\n\nAs a first step, attempt to detect that we\u0027re dealing\nwith such a situation, so mac80211 can use this later."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T08:44:58.704Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ce112c941c2b172afba3e913a90c380647d53975"
        },
        {
          "url": "https://git.kernel.org/stable/c/177fbbcb4ed6b306c1626a277fac3fb1c495a4c7"
        }
      ],
      "title": "wifi: cfg80211: detect stuck ECSA element in probe resp",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26683",
    "datePublished": "2024-04-02T07:01:45.996Z",
    "dateReserved": "2024-02-19T14:20:24.153Z",
    "dateUpdated": "2024-12-19T08:44:58.704Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26683\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-02T07:15:44.700\",\"lastModified\":\"2024-11-21T09:02:50.280\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: cfg80211: detect stuck ECSA element in probe resp\\n\\nWe recently added some validation that we don\u0027t try to\\nconnect to an AP that is currently in a channel switch\\nprocess, since that might want the channel to be quiet\\nor we might not be able to connect in time to hear the\\nswitching in a beacon. This was in commit c09c4f31998b\\n(\\\"wifi: mac80211: don\u0027t connect to an AP while it\u0027s in\\na CSA process\\\").\\n\\nHowever, we promptly got a report that this caused new\\nconnection failures, and it turns out that the AP that\\nwe now cannot connect to is permanently advertising an\\nextended channel switch announcement, even with quiet.\\nThe AP in question was an Asus RT-AC53, with firmware\\n3.0.0.4.380_10760-g21a5898.\\n\\nAs a first step, attempt to detect that we\u0027re dealing\\nwith such a situation, so mac80211 can use this later.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: \\\"wifi: cfg80211: detect stuck ECSA element in probe resp\\\". Recientemente agregamos alguna validaci\u00f3n de que no intentamos conectarnos a un AP que se encuentra actualmente en un proceso de cambio de canal, desde entonces es posible que deseemos que el canal est\u00e9 en silencio o que no podamos conectarnos a tiempo para escuchar el cambio en una baliza. Esto estaba en el commit c09c4f31998b (\\\"wifi: mac80211: no se conecte a un AP mientras est\u00e9 en un proceso CSA\\\"). Sin embargo, r\u00e1pidamente recibimos un informe de que esto caus\u00f3 nuevas fallas de conexi\u00f3n, y resulta que el AP al que ahora no podemos conectarnos anuncia permanentemente un anuncio de cambio de canal extendido, incluso en silencio. El AP en cuesti\u00f3n era un Asus RT-AC53, con firmware 3.0.0.4.380_10760-g21a5898. Como primer paso, intente detectar que estamos lidiando con una situaci\u00f3n de este tipo, para que mac80211 pueda usarlo m\u00e1s adelante.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/177fbbcb4ed6b306c1626a277fac3fb1c495a4c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ce112c941c2b172afba3e913a90c380647d53975\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/177fbbcb4ed6b306c1626a277fac3fb1c495a4c7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/ce112c941c2b172afba3e913a90c380647d53975\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.