CVE-2024-26683 (GCVE-0-2024-26683)

Vulnerability from cvelistv5 – Published: 2024-04-02 07:01 – Updated: 2025-05-04 08:53
VLAI?
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: detect stuck ECSA element in probe resp We recently added some validation that we don't try to connect to an AP that is currently in a channel switch process, since that might want the channel to be quiet or we might not be able to connect in time to hear the switching in a beacon. This was in commit c09c4f31998b ("wifi: mac80211: don't connect to an AP while it's in a CSA process"). However, we promptly got a report that this caused new connection failures, and it turns out that the AP that we now cannot connect to is permanently advertising an extended channel switch announcement, even with quiet. The AP in question was an Asus RT-AC53, with firmware 3.0.0.4.380_10760-g21a5898. As a first step, attempt to detect that we're dealing with such a situation, so mac80211 can use this later.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: c09c4f31998bac6d73508e38812518aceb069b68 , < ce112c941c2b172afba3e913a90c380647d53975 (git)
Affected: c09c4f31998bac6d73508e38812518aceb069b68 , < 177fbbcb4ed6b306c1626a277fac3fb1c495a4c7 (git)
Create a notification for this product.
    Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.7.5 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26683",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-03T15:15:07.235616Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:48:53.665Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:12.754Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ce112c941c2b172afba3e913a90c380647d53975"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/177fbbcb4ed6b306c1626a277fac3fb1c495a4c7"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/cfg80211.h",
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ce112c941c2b172afba3e913a90c380647d53975",
              "status": "affected",
              "version": "c09c4f31998bac6d73508e38812518aceb069b68",
              "versionType": "git"
            },
            {
              "lessThan": "177fbbcb4ed6b306c1626a277fac3fb1c495a4c7",
              "status": "affected",
              "version": "c09c4f31998bac6d73508e38812518aceb069b68",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/cfg80211.h",
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.5",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: detect stuck ECSA element in probe resp\n\nWe recently added some validation that we don\u0027t try to\nconnect to an AP that is currently in a channel switch\nprocess, since that might want the channel to be quiet\nor we might not be able to connect in time to hear the\nswitching in a beacon. This was in commit c09c4f31998b\n(\"wifi: mac80211: don\u0027t connect to an AP while it\u0027s in\na CSA process\").\n\nHowever, we promptly got a report that this caused new\nconnection failures, and it turns out that the AP that\nwe now cannot connect to is permanently advertising an\nextended channel switch announcement, even with quiet.\nThe AP in question was an Asus RT-AC53, with firmware\n3.0.0.4.380_10760-g21a5898.\n\nAs a first step, attempt to detect that we\u0027re dealing\nwith such a situation, so mac80211 can use this later."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:53:58.146Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ce112c941c2b172afba3e913a90c380647d53975"
        },
        {
          "url": "https://git.kernel.org/stable/c/177fbbcb4ed6b306c1626a277fac3fb1c495a4c7"
        }
      ],
      "title": "wifi: cfg80211: detect stuck ECSA element in probe resp",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26683",
    "datePublished": "2024-04-02T07:01:45.996Z",
    "dateReserved": "2024-02-19T14:20:24.153Z",
    "dateUpdated": "2025-05-04T08:53:58.146Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: cfg80211: detect stuck ECSA element in probe resp\\n\\nWe recently added some validation that we don\u0027t try to\\nconnect to an AP that is currently in a channel switch\\nprocess, since that might want the channel to be quiet\\nor we might not be able to connect in time to hear the\\nswitching in a beacon. This was in commit c09c4f31998b\\n(\\\"wifi: mac80211: don\u0027t connect to an AP while it\u0027s in\\na CSA process\\\").\\n\\nHowever, we promptly got a report that this caused new\\nconnection failures, and it turns out that the AP that\\nwe now cannot connect to is permanently advertising an\\nextended channel switch announcement, even with quiet.\\nThe AP in question was an Asus RT-AC53, with firmware\\n3.0.0.4.380_10760-g21a5898.\\n\\nAs a first step, attempt to detect that we\u0027re dealing\\nwith such a situation, so mac80211 can use this later.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: \\\"wifi: cfg80211: detect stuck ECSA element in probe resp\\\". Recientemente agregamos alguna validaci\\u00f3n de que no intentamos conectarnos a un AP que se encuentra actualmente en un proceso de cambio de canal, desde entonces es posible que deseemos que el canal est\\u00e9 en silencio o que no podamos conectarnos a tiempo para escuchar el cambio en una baliza. Esto estaba en el commit c09c4f31998b (\\\"wifi: mac80211: no se conecte a un AP mientras est\\u00e9 en un proceso CSA\\\"). Sin embargo, r\\u00e1pidamente recibimos un informe de que esto caus\\u00f3 nuevas fallas de conexi\\u00f3n, y resulta que el AP al que ahora no podemos conectarnos anuncia permanentemente un anuncio de cambio de canal extendido, incluso en silencio. El AP en cuesti\\u00f3n era un Asus RT-AC53, con firmware 3.0.0.4.380_10760-g21a5898. Como primer paso, intente detectar que estamos lidiando con una situaci\\u00f3n de este tipo, para que mac80211 pueda usarlo m\\u00e1s adelante.\"}]",
      "id": "CVE-2024-26683",
      "lastModified": "2024-11-21T09:02:50.280",
      "published": "2024-04-02T07:15:44.700",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/177fbbcb4ed6b306c1626a277fac3fb1c495a4c7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ce112c941c2b172afba3e913a90c380647d53975\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/177fbbcb4ed6b306c1626a277fac3fb1c495a4c7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/ce112c941c2b172afba3e913a90c380647d53975\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26683\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-02T07:15:44.700\",\"lastModified\":\"2025-03-17T15:41:11.497\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: cfg80211: detect stuck ECSA element in probe resp\\n\\nWe recently added some validation that we don\u0027t try to\\nconnect to an AP that is currently in a channel switch\\nprocess, since that might want the channel to be quiet\\nor we might not be able to connect in time to hear the\\nswitching in a beacon. This was in commit c09c4f31998b\\n(\\\"wifi: mac80211: don\u0027t connect to an AP while it\u0027s in\\na CSA process\\\").\\n\\nHowever, we promptly got a report that this caused new\\nconnection failures, and it turns out that the AP that\\nwe now cannot connect to is permanently advertising an\\nextended channel switch announcement, even with quiet.\\nThe AP in question was an Asus RT-AC53, with firmware\\n3.0.0.4.380_10760-g21a5898.\\n\\nAs a first step, attempt to detect that we\u0027re dealing\\nwith such a situation, so mac80211 can use this later.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: \\\"wifi: cfg80211: detect stuck ECSA element in probe resp\\\". Recientemente agregamos alguna validaci\u00f3n de que no intentamos conectarnos a un AP que se encuentra actualmente en un proceso de cambio de canal, desde entonces es posible que deseemos que el canal est\u00e9 en silencio o que no podamos conectarnos a tiempo para escuchar el cambio en una baliza. Esto estaba en el commit c09c4f31998b (\\\"wifi: mac80211: no se conecte a un AP mientras est\u00e9 en un proceso CSA\\\"). Sin embargo, r\u00e1pidamente recibimos un informe de que esto caus\u00f3 nuevas fallas de conexi\u00f3n, y resulta que el AP al que ahora no podemos conectarnos anuncia permanentemente un anuncio de cambio de canal extendido, incluso en silencio. El AP en cuesti\u00f3n era un Asus RT-AC53, con firmware 3.0.0.4.380_10760-g21a5898. Como primer paso, intente detectar que estamos lidiando con una situaci\u00f3n de este tipo, para que mac80211 pueda usarlo m\u00e1s adelante.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.5\",\"matchCriteriaId\":\"01925741-2C95-47C1-A7EA-3DC2BB0012D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/177fbbcb4ed6b306c1626a277fac3fb1c495a4c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ce112c941c2b172afba3e913a90c380647d53975\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/177fbbcb4ed6b306c1626a277fac3fb1c495a4c7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ce112c941c2b172afba3e913a90c380647d53975\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ce112c941c2b172afba3e913a90c380647d53975\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/177fbbcb4ed6b306c1626a277fac3fb1c495a4c7\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:12.754Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26683\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-03T15:15:07.235616Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:21.459Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"wifi: cfg80211: detect stuck ECSA element in probe resp\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c09c4f31998bac6d73508e38812518aceb069b68\", \"lessThan\": \"ce112c941c2b172afba3e913a90c380647d53975\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c09c4f31998bac6d73508e38812518aceb069b68\", \"lessThan\": \"177fbbcb4ed6b306c1626a277fac3fb1c495a4c7\", \"versionType\": \"git\"}], \"programFiles\": [\"include/net/cfg80211.h\", \"net/wireless/scan.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.7.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/net/cfg80211.h\", \"net/wireless/scan.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ce112c941c2b172afba3e913a90c380647d53975\"}, {\"url\": \"https://git.kernel.org/stable/c/177fbbcb4ed6b306c1626a277fac3fb1c495a4c7\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: cfg80211: detect stuck ECSA element in probe resp\\n\\nWe recently added some validation that we don\u0027t try to\\nconnect to an AP that is currently in a channel switch\\nprocess, since that might want the channel to be quiet\\nor we might not be able to connect in time to hear the\\nswitching in a beacon. This was in commit c09c4f31998b\\n(\\\"wifi: mac80211: don\u0027t connect to an AP while it\u0027s in\\na CSA process\\\").\\n\\nHowever, we promptly got a report that this caused new\\nconnection failures, and it turns out that the AP that\\nwe now cannot connect to is permanently advertising an\\nextended channel switch announcement, even with quiet.\\nThe AP in question was an Asus RT-AC53, with firmware\\n3.0.0.4.380_10760-g21a5898.\\n\\nAs a first step, attempt to detect that we\u0027re dealing\\nwith such a situation, so mac80211 can use this later.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.5\", \"versionStartIncluding\": \"6.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"6.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T08:53:58.146Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26683\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T08:53:58.146Z\", \"dateReserved\": \"2024-02-19T14:20:24.153Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-02T07:01:45.996Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.