CVE-2024-47721 (GCVE-0-2024-47721)

Vulnerability from cvelistv5 – Published: 2024-10-21 11:53 – Updated: 2026-08-05 11:39
VLAI
Title
wifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading The handler of firmware C2H event RTW89_MAC_C2H_FUNC_READ_WOW_CAM isn't implemented, but driver expects number of handlers is NUM_OF_RTW89_MAC_C2H_FUNC_WOW causing out-of-bounds access. Fix it by removing ID. Addresses-Coverity-ID: 1598775 ("Out-of-bounds read")
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-21 13:02 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ff53fce5c78ba27ec7eb0baff7ef9648fde7ad8e , < 10463308b9454f534d03300cf679bc4b3d078f46 (git)
Affected: ff53fce5c78ba27ec7eb0baff7ef9648fde7ad8e , < 2c9c2d1a20916589497a7facbea3e82cabec4ab8 (git)
Affected: ff53fce5c78ba27ec7eb0baff7ef9648fde7ad8e , < 56310ddb50b190b3390fdc974aec455d0a516bd2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.10.13 , ≤ 6.10.* (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47721",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T13:02:00.306477Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:04:17.474Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw89/mac.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "10463308b9454f534d03300cf679bc4b3d078f46",
              "status": "affected",
              "version": "ff53fce5c78ba27ec7eb0baff7ef9648fde7ad8e",
              "versionType": "git"
            },
            {
              "lessThan": "2c9c2d1a20916589497a7facbea3e82cabec4ab8",
              "status": "affected",
              "version": "ff53fce5c78ba27ec7eb0baff7ef9648fde7ad8e",
              "versionType": "git"
            },
            {
              "lessThan": "56310ddb50b190b3390fdc974aec455d0a516bd2",
              "status": "affected",
              "version": "ff53fce5c78ba27ec7eb0baff7ef9648fde7ad8e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw89/mac.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading\n\nThe handler of firmware C2H event RTW89_MAC_C2H_FUNC_READ_WOW_CAM isn\u0027t\nimplemented, but driver expects number of handlers is\nNUM_OF_RTW89_MAC_C2H_FUNC_WOW causing out-of-bounds access. Fix it by\nremoving ID.\n\nAddresses-Coverity-ID: 1598775 (\"Out-of-bounds read\")"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The malicious C2H event originates from the Wi-Fi device firmware, whose state and event emission are driven by over-the-air activity (WoWLAN wake patterns, association/rekey traffic) from an attacker within radio range, and the WOW-class dispatch path is entered directly from the device interrupt handler. Consistent with kernel CNA practice for firmware-supplied-index OOB bugs in wireless drivers, this is Adjacent rather than Network.\nAC:L - The class and func fields are consumed verbatim from the C2H header with no validation whatsoever, so a single event with class=0x3/func=1 deterministically triggers the out-of-bounds fetch and indirect call \u2014 no race, no memory-layout grooming, and no timing window is involved.\nPR:N - The C2H dispatch path is gated only by RTW89_FLAG_RUNNING (interface up); there is no capability check, no authentication, and no requirement that WoWLAN was configured by a privileged process. The attacker needs no credentials on the target system.\nUI:N - No victim action is required \u2014 the event is processed asynchronously in the driver\u0027s interrupt/work path as soon as it arrives, independent of any user activity such as suspending the machine or configuring WoWLAN.\nS:U - The out-of-bounds read and the resulting indirect call both occur within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Reading past the one-element handler table and invoking the resulting pointer produces a type confusion with adjacent same-signature C2H handlers, which cast skb-\u003edata to fixed structs and memcpy fixed lengths without honoring len \u2014 leaking out-of-bounds heap contents into driver state, including WoWLAN key-material buffers (GTK/PTK/IGTK/IV). Combined with the leak of kernel .rodata contents through the branch target, this is a high confidentiality impact.\nI:H - The OOB slot is dereferenced as a function pointer and called, so an attacker-induced event transfers control to an address the kernel never intended to branch to \u2014 a control-flow-integrity violation and potential code-execution primitive \u2014 while the type-confused handler also writes unvalidated firmware-controlled data into driver key/state structures.\nA:H - Calling a garbage or mismatched function pointer from interrupt/atomic context reliably produces a kernel oops, CFI panic, or memory corruption crash, and the event can be re-delivered repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:39:41.958Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/10463308b9454f534d03300cf679bc4b3d078f46"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c9c2d1a20916589497a7facbea3e82cabec4ab8"
        },
        {
          "url": "https://git.kernel.org/stable/c/56310ddb50b190b3390fdc974aec455d0a516bd2"
        }
      ],
      "title": "wifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47721",
    "datePublished": "2024-10-21T11:53:50.861Z",
    "dateReserved": "2024-09-30T16:00:12.950Z",
    "dateUpdated": "2026-08-05T11:39:41.958Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47721",
      "date": "2026-09-21",
      "epss": "0.00319",
      "percentile": "0.2501"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "767D4D2D-C6E7-4B7D-9446-CFC8F8FF2FBB",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "AB755D26-97F4-43B6-8604-CD076811E181",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading\n\nThe handler of firmware C2H event RTW89_MAC_C2H_FUNC_READ_WOW_CAM isn\u0027t\nimplemented, but driver expects number of handlers is\nNUM_OF_RTW89_MAC_C2H_FUNC_WOW causing out-of-bounds access. Fix it by\nremoving ID.\n\nAddresses-Coverity-ID: 1598775 (\"Out-of-bounds read\")"
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: rtw89: eliminar el ID de evento C2H no utilizado RTW89_MAC_C2H_FUNC_READ_WOW_CAM para evitar la lectura fuera de los l\u00edmites El controlador del evento C2H del firmware RTW89_MAC_C2H_FUNC_READ_WOW_CAM no est\u00e1 implementado, pero el controlador espera que el n\u00famero de controladores sea NUM_OF_RTW89_MAC_C2H_FUNC_WOW, lo que provoca un acceso fuera de los l\u00edmites. Solucione el problema eliminando el ID. Addresses-Coverity-ID: 1598775 (\"Lectura fuera de los l\u00edmites\")"
        }
      ],
      "id": "CVE-2024-47721",
      "lastModified": "2024-10-23T20:57:04.897",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 5.2,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-10-21T12:15:08.313",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/10463308b9454f534d03300cf679bc4b3d078f46"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/2c9c2d1a20916589497a7facbea3e82cabec4ab8"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/56310ddb50b190b3390fdc974aec455d0a516bd2"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-125"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/realtek/rtw89/mac.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "10463308b9454f534d03300cf679bc4b3d078f46",
                    "status": "affected",
                    "version": "ff53fce5c78ba27ec7eb0baff7ef9648fde7ad8e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2c9c2d1a20916589497a7facbea3e82cabec4ab8",
                    "status": "affected",
                    "version": "ff53fce5c78ba27ec7eb0baff7ef9648fde7ad8e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "56310ddb50b190b3390fdc974aec455d0a516bd2",
                    "status": "affected",
                    "version": "ff53fce5c78ba27ec7eb0baff7ef9648fde7ad8e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/realtek/rtw89/mac.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.10"
                  },
                  {
                    "lessThan": "6.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.10.*",
                    "status": "unaffected",
                    "version": "6.10.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.11.*",
                    "status": "unaffected",
                    "version": "6.11.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.12",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "767D4D2D-C6E7-4B7D-9446-CFC8F8FF2FBB",
                    "versionEndExcluding": "6.10.13",
                    "versionStartIncluding": "6.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AB755D26-97F4-43B6-8604-CD076811E181",
                    "versionEndExcluding": "6.11.2",
                    "versionStartIncluding": "6.11",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading\n\nThe handler of firmware C2H event RTW89_MAC_C2H_FUNC_READ_WOW_CAM isn\u0027t\nimplemented, but driver expects number of handlers is\nNUM_OF_RTW89_MAC_C2H_FUNC_WOW causing out-of-bounds access. Fix it by\nremoving ID.\n\nAddresses-Coverity-ID: 1598775 (\"Out-of-bounds read\")"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: rtw89: eliminar el ID de evento C2H no utilizado RTW89_MAC_C2H_FUNC_READ_WOW_CAM para evitar la lectura fuera de los l\u00edmites El controlador del evento C2H del firmware RTW89_MAC_C2H_FUNC_READ_WOW_CAM no est\u00e1 implementado, pero el controlador espera que el n\u00famero de controladores sea NUM_OF_RTW89_MAC_C2H_FUNC_WOW, lo que provoca un acceso fuera de los l\u00edmites. Solucione el problema eliminando el ID. Addresses-Coverity-ID: 1598775 (\"Lectura fuera de los l\u00edmites\")"
          }
        ],
        "id": "CVE-2024-47721",
        "lastModified": "2026-08-04T11:20:44.127",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-47721",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T13:02:00.306477Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-10-21T12:15:08.313",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/10463308b9454f534d03300cf679bc4b3d078f46"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2c9c2d1a20916589497a7facbea3e82cabec4ab8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/56310ddb50b190b3390fdc974aec455d0a516bd2"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T10:00:37+00:00",
      "cve": "CVE-2024-47721",
      "id": "CVE-2024-47721",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47721.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-31T00:31:07Z",
      "cve": "CVE-2024-47721",
      "id": "CVE-2024-47721",
      "initial_release_date": "2024-10-21T15:46:54Z",
      "product_status:known_not_affected": "498",
      "product_status:recommended": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-47721",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-47721.json",
      "version": "28"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-47721",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-10-21T13:02:00.306477Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-10-21T13:02:03.557Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/wireless/realtek/rtw89/mac.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "10463308b9454f534d03300cf679bc4b3d078f46",
                  "status": "affected",
                  "version": "ff53fce5c78ba27ec7eb0baff7ef9648fde7ad8e",
                  "versionType": "git"
                },
                {
                  "lessThan": "2c9c2d1a20916589497a7facbea3e82cabec4ab8",
                  "status": "affected",
                  "version": "ff53fce5c78ba27ec7eb0baff7ef9648fde7ad8e",
                  "versionType": "git"
                },
                {
                  "lessThan": "56310ddb50b190b3390fdc974aec455d0a516bd2",
                  "status": "affected",
                  "version": "ff53fce5c78ba27ec7eb0baff7ef9648fde7ad8e",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/wireless/realtek/rtw89/mac.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.10"
                },
                {
                  "lessThan": "6.10",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.10.*",
                  "status": "unaffected",
                  "version": "6.10.13",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.11.*",
                  "status": "unaffected",
                  "version": "6.11.2",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.12",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.10.13",
                      "versionStartIncluding": "6.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.11.2",
                      "versionStartIncluding": "6.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12",
                      "versionStartIncluding": "6.10",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading\n\nThe handler of firmware C2H event RTW89_MAC_C2H_FUNC_READ_WOW_CAM isn\u0027t\nimplemented, but driver expects number of handlers is\nNUM_OF_RTW89_MAC_C2H_FUNC_WOW causing out-of-bounds access. Fix it by\nremoving ID.\n\nAddresses-Coverity-ID: 1598775 (\"Out-of-bounds read\")"
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-05-04T09:38:16.712Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/10463308b9454f534d03300cf679bc4b3d078f46"
            },
            {
              "url": "https://git.kernel.org/stable/c/2c9c2d1a20916589497a7facbea3e82cabec4ab8"
            },
            {
              "url": "https://git.kernel.org/stable/c/56310ddb50b190b3390fdc974aec455d0a516bd2"
            }
          ],
          "title": "wifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-47721",
        "datePublished": "2024-10-21T11:53:50.861Z",
        "dateReserved": "2024-09-30T16:00:12.950Z",
        "dateUpdated": "2025-05-04T09:38:16.712Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.