CVE-2024-43848 (GCVE-0-2024-43848)

Vulnerability from cvelistv5 – Published: 2024-08-17 09:22 – Updated: 2026-08-05 11:36
VLAI
Title
wifi: mac80211: fix TTLM teardown work
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix TTLM teardown work The worker calculates the wrong sdata pointer, so if it ever runs, it'll crash. Fix that.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:07 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a17a58ad2ff24f0d201fa5f9939182f3757d1737 , < 9750899410c8478ef043c42029f4f6144c096eac (git)
Affected: a17a58ad2ff24f0d201fa5f9939182f3757d1737 , < 2fe0a605d083b884490ee4de02be071b5b4291b1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.10.3 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43848",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:07:33.635400Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:21.571Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/mlme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9750899410c8478ef043c42029f4f6144c096eac",
              "status": "affected",
              "version": "a17a58ad2ff24f0d201fa5f9939182f3757d1737",
              "versionType": "git"
            },
            {
              "lessThan": "2fe0a605d083b884490ee4de02be071b5b4291b1",
              "status": "affected",
              "version": "a17a58ad2ff24f0d201fa5f9939182f3757d1737",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/mlme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix TTLM teardown work\n\nThe worker calculates the wrong sdata pointer, so if it ever\nruns, it\u0027ll crash. Fix that."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable work is armed by 802.11 TX-status processing for an MLO/TTLM teardown frame, and its preconditions (MLD association plus an active negotiated TID-to-link mapping installed via PROTECTED_EHT action frames) are established entirely over the air by the peer AP. This requires radio-range/same-WiFi-segment access, matching the Adjacent vector used for mac80211 frame-driven bugs.\nAC:L - A rogue or evil-twin MLD AP fully controls the setup \u2014 it negotiates the TTLM that restricts links and ACKs the resulting teardown frame that queues the work \u2014 and once queued the fault is deterministic, since the bad pointer is a fixed -32-byte offset with no dependence on memory layout or timing.\nPR:N - The attacker operates as an 802.11be AP in radio range and needs no account, credentials, or any privilege on the victim system. No local access to the target is involved at any point in the path.\nUI:N - Association to a known/evil-twin SSID happens automatically via the supplicant\u0027s auto-join, and the teardown is initiated by the driver\u0027s own link-activation logic rather than by any user action. No victim interaction is needed to reach the faulty worker.\nS:U - The type confusion, the corrupting write, and the wild dereference all occur within the kernel\u0027s own memory and security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The wrong `container_of` yields a systematic type confusion in which `vif`, `local`, `flags`, `dev` and `link[]` are all read 32 bytes off, and the resulting bogus `local` (sourced from a timer `expires` field in the sub-4 GB, user-mappable range on non-SMAP systems) is dereferenced and used to reach `local-\u003eops`, providing a read primitive over attacker-influenceable memory.\nI:H - The worker performs a 34-byte zeroing write 32 bytes before the intended target, clobbering live `vif.link_conf[12..14]`, `valid_links`, `active_links`, `dormant_links` and `suspended_links` on an active MLD connection, and then reaches an indirect call `local-\u003eops-\u003evif_cfg_changed()` through the confused pointer \u2014 memory corruption leverageable for control-flow hijacking.\nA:H - As the fix commit states outright, \"if it ever runs, it\u0027ll crash\": the bogus `local` pointer (NULL or a jiffies-derived address) is dereferenced in `drv_vif_cfg_changed()`, producing a kernel oops in the wiphy work handler, on top of MLD state corruption that causes further NULL dereferences."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:46.994Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9750899410c8478ef043c42029f4f6144c096eac"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fe0a605d083b884490ee4de02be071b5b4291b1"
        }
      ],
      "title": "wifi: mac80211: fix TTLM teardown work",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-43848",
    "datePublished": "2024-08-17T09:22:02.044Z",
    "dateReserved": "2024-08-17T09:11:59.276Z",
    "dateUpdated": "2026-08-05T11:36:46.994Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-43848",
      "date": "2026-08-20",
      "epss": "0.00263",
      "percentile": "0.18243"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.10\", \"versionEndExcluding\": \"6.10.3\", \"matchCriteriaId\": \"21DC7A88-E88C-4C44-9AFB-CBB30134097C\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mac80211: fix TTLM teardown work\\n\\nThe worker calculates the wrong sdata pointer, so if it ever\\nruns, it\u0027ll crash. Fix that.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: wifi: mac80211: arreglar el trabajo de desmontaje de TTLM El trabajador calcula el puntero sdata incorrecto, por lo que si alguna vez se ejecuta, fallar\\u00e1. Arregla eso.\"}]",
      "id": "CVE-2024-43848",
      "lastModified": "2024-10-25T13:57:51.800",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-08-17T10:15:10.023",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/2fe0a605d083b884490ee4de02be071b5b4291b1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9750899410c8478ef043c42029f4f6144c096eac\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-43848\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-17T10:15:10.023\",\"lastModified\":\"2026-08-04T11:19:54.780\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mac80211: fix TTLM teardown work\\n\\nThe worker calculates the wrong sdata pointer, so if it ever\\nruns, it\u0027ll crash. Fix that.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: wifi: mac80211: arreglar el trabajo de desmontaje de TTLM El trabajador calcula el puntero sdata incorrecto, por lo que si alguna vez se ejecuta, fallar\u00e1. Arregla eso.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/mac80211/mlme.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a17a58ad2ff24f0d201fa5f9939182f3757d1737\",\"lessThan\":\"9750899410c8478ef043c42029f4f6144c096eac\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a17a58ad2ff24f0d201fa5f9939182f3757d1737\",\"lessThan\":\"2fe0a605d083b884490ee4de02be071b5b4291b1\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/mac80211/mlme.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.3\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:07:33.635400Z\",\"id\":\"CVE-2024-43848\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10\",\"versionEndExcluding\":\"6.10.3\",\"matchCriteriaId\":\"21DC7A88-E88C-4C44-9AFB-CBB30134097C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2fe0a605d083b884490ee4de02be071b5b4291b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9750899410c8478ef043c42029f4f6144c096eac\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:13:28+00:00",
      "cve": "CVE-2024-43848",
      "id": "CVE-2024-43848",
      "initial_release_date": "2024-08-17T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mac80211: fix TTLM teardown work",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-43848.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:53:56Z",
      "cve": "CVE-2024-43848",
      "id": "CVE-2024-43848",
      "initial_release_date": "2024-08-18T02:01:29Z",
      "product_status:known_not_affected": "310",
      "product_status:recommended": "59",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-43848",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-43848.json",
      "version": "21"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43848\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:07:33.635400Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:22.969Z\"}}], \"cna\": {\"title\": \"wifi: mac80211: fix TTLM teardown work\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"a17a58ad2ff24f0d201fa5f9939182f3757d1737\", \"lessThan\": \"9750899410c8478ef043c42029f4f6144c096eac\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a17a58ad2ff24f0d201fa5f9939182f3757d1737\", \"lessThan\": \"2fe0a605d083b884490ee4de02be071b5b4291b1\", \"versionType\": \"git\"}], \"programFiles\": [\"net/mac80211/mlme.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/mac80211/mlme.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9750899410c8478ef043c42029f4f6144c096eac\"}, {\"url\": \"https://git.kernel.org/stable/c/2fe0a605d083b884490ee4de02be071b5b4291b1\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mac80211: fix TTLM teardown work\\n\\nThe worker calculates the wrong sdata pointer, so if it ever\\nruns, it\u0027ll crash. Fix that.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.3\", \"versionStartIncluding\": \"6.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"6.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:30:59.119Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-43848\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:30:59.119Z\", \"dateReserved\": \"2024-08-17T09:11:59.276Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-17T09:22:02.044Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.