CVE-2024-27056 (GCVE-0-2024-27056)

Vulnerability from cvelistv5 – Published: 2024-05-01 12:54 – Updated: 2026-08-05 11:29
VLAI
Title
wifi: iwlwifi: mvm: ensure offloading TID queue exists
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: ensure offloading TID queue exists The resume code path assumes that the TX queue for the offloading TID has been configured. At resume time it then tries to sync the write pointer as it may have been updated by the firmware. In the unusual event that no packets have been send on TID 0, the queue will not have been allocated and this causes a crash. Fix this by ensuring the queue exist at suspend time.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: ba7136f3f9e849e5776429317bf45ac3d4cfa3f7 , < 4903303f25f48b5a1e34e6324c7fae9ccd6b959a (git)
Affected: ba7136f3f9e849e5776429317bf45ac3d4cfa3f7 , < 35afffaddbe8d310dc61659da0b1a337b0d0addc (git)
Affected: ba7136f3f9e849e5776429317bf45ac3d4cfa3f7 , < ed35a509390ef4011ea2226da5dd6f62b73873b5 (git)
Affected: ba7136f3f9e849e5776429317bf45ac3d4cfa3f7 , < 78f65fbf421a61894c14a1b91fe2fb4437b3fe5f (git)
Create a notification for this product.
Linux Linux Affected: 5.4
Unaffected: 0 , < 5.4 (semver)
Unaffected: 6.1.132 , ≤ 6.1.* (semver)
Unaffected: 6.6.85 , ≤ 6.6.* (semver)
Unaffected: 6.7.11 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27056",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-14T18:56:53.043911Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-14T18:56:59.749Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:29:41.505Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ed35a509390ef4011ea2226da5dd6f62b73873b5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/78f65fbf421a61894c14a1b91fe2fb4437b3fe5f"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:37:43.339Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/mvm/d3.c",
            "drivers/net/wireless/intel/iwlwifi/mvm/sta.c",
            "drivers/net/wireless/intel/iwlwifi/mvm/sta.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4903303f25f48b5a1e34e6324c7fae9ccd6b959a",
              "status": "affected",
              "version": "ba7136f3f9e849e5776429317bf45ac3d4cfa3f7",
              "versionType": "git"
            },
            {
              "lessThan": "35afffaddbe8d310dc61659da0b1a337b0d0addc",
              "status": "affected",
              "version": "ba7136f3f9e849e5776429317bf45ac3d4cfa3f7",
              "versionType": "git"
            },
            {
              "lessThan": "ed35a509390ef4011ea2226da5dd6f62b73873b5",
              "status": "affected",
              "version": "ba7136f3f9e849e5776429317bf45ac3d4cfa3f7",
              "versionType": "git"
            },
            {
              "lessThan": "78f65fbf421a61894c14a1b91fe2fb4437b3fe5f",
              "status": "affected",
              "version": "ba7136f3f9e849e5776429317bf45ac3d4cfa3f7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlwifi/mvm/d3.c",
            "drivers/net/wireless/intel/iwlwifi/mvm/sta.c",
            "drivers/net/wireless/intel/iwlwifi/mvm/sta.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.132",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.85",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.132",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.85",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.11",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: ensure offloading TID queue exists\n\nThe resume code path assumes that the TX queue for the offloading TID\nhas been configured. At resume time it then tries to sync the write\npointer as it may have been updated by the firmware.\n\nIn the unusual event that no packets have been send on TID 0, the queue\nwill not have been allocated and this causes a crash. Fix this by\nensuring the queue exist at suspend time."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The faulting code is only entered through a local system suspend/resume (D3/WoWLAN) cycle initiated on the machine itself; no received frame or network input reaches `iwl_mvm_query_wakeup_reasons()` on its own. An adjacent WiFi actor can shape the precondition and even drive the WoWLAN wake, but the power-management transition is the local entry point.\nAC:L - The precondition \u2014 TID 0\u0027s DQA queue never allocated \u2014 is deterministically reachable by suspending after a fresh (re)association or on a link with no UP-0 uplink traffic, and can be forced outright via a QoS Map that steers all traffic off UP 0. Once that state holds, every resume hits the bug with no race to win.\nPR:L - An unprivileged local user on a desktop session can request suspend through logind/polkit, and idle autosuspend reaches it with no privileges at all. No CAP_NET_ADMIN or root is needed to trigger the resume path once WoWLAN is configured, which is the normal state on managed laptop fleets and Chromebooks.\nUI:N - No victim action is required beyond the routine suspend/resume that laptops, tablets and embedded devices perform automatically on idle or lid close. The crash occurs unconditionally in the resume handler.\nS:U - The out-of-bounds access and the corrupted memory both live in the kernel\u0027s own address space within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - `trans-\u003etxqs.txq[0xFFFF]` reads 8 bytes roughly 512 KB past a 512-entry array \u2014 an unbounded out-of-bounds read of unrelated kernel heap, not a few-byte bounded overread. The resulting memory corruption is of the class that can be leveraged for kernel memory disclosure.\nI:H - The out-of-bounds value is dereferenced as a `struct iwl_txq *`, so `spin_lock_bh(\u0026txq-\u003elock)` performs an atomic read-modify-write and `txq-\u003ewrite_ptr`/`read_ptr` store through a kernel pointer the code never validated. That is a write to an out-of-bounds address, i.e. kernel memory corruption of the kind exploitable for control-flow hijacking.\nA:H - Dereferencing a garbage pointer read from beyond the array reliably oopses during system resume, and taking a bogus spinlock can wedge the resume path entirely. The commit message describes it plainly as \"this causes a crash.\""
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:16.379Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4903303f25f48b5a1e34e6324c7fae9ccd6b959a"
        },
        {
          "url": "https://git.kernel.org/stable/c/35afffaddbe8d310dc61659da0b1a337b0d0addc"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed35a509390ef4011ea2226da5dd6f62b73873b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/78f65fbf421a61894c14a1b91fe2fb4437b3fe5f"
        }
      ],
      "title": "wifi: iwlwifi: mvm: ensure offloading TID queue exists",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27056",
    "datePublished": "2024-05-01T12:54:56.461Z",
    "dateReserved": "2024-02-19T14:20:24.214Z",
    "dateUpdated": "2026-08-05T11:29:16.379Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-27056",
      "date": "2026-08-06",
      "epss": "0.00249",
      "percentile": "0.16277"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: iwlwifi: mvm: ensure offloading TID queue exists\\n\\nThe resume code path assumes that the TX queue for the offloading TID\\nhas been configured. At resume time it then tries to sync the write\\npointer as it may have been updated by the firmware.\\n\\nIn the unusual event that no packets have been send on TID 0, the queue\\nwill not have been allocated and this causes a crash. Fix this by\\nensuring the queue exist at suspend time.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: iwlwifi: mvm: aseg\\u00farese de que exista la cola de descarga TID La ruta del c\\u00f3digo de reanudaci\\u00f3n supone que se ha configurado la cola de TX para la descarga de TID. En el momento de la reanudaci\\u00f3n, intenta sincronizar el puntero de escritura, ya que es posible que el firmware lo haya actualizado. En el caso inusual de que no se hayan enviado paquetes en el TID 0, la cola no se habr\\u00e1 asignado y esto provocar\\u00e1 una falla. Solucione este problema asegur\\u00e1ndose de que la cola exista en el momento de la suspensi\\u00f3n.\"}]",
      "id": "CVE-2024-27056",
      "lastModified": "2024-11-21T09:03:45.980",
      "published": "2024-05-01T13:15:50.360",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/78f65fbf421a61894c14a1b91fe2fb4437b3fe5f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ed35a509390ef4011ea2226da5dd6f62b73873b5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/78f65fbf421a61894c14a1b91fe2fb4437b3fe5f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/ed35a509390ef4011ea2226da5dd6f62b73873b5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:02:03.000Z",
      "cve": "CVE-2024-27056",
      "id": "msrc_CVE-2024-27056",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: iwlwifi: mvm: ensure offloading TID queue exists",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-27056.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-27056\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-01T13:15:50.360\",\"lastModified\":\"2026-08-04T11:17:38.850\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: iwlwifi: mvm: ensure offloading TID queue exists\\n\\nThe resume code path assumes that the TX queue for the offloading TID\\nhas been configured. At resume time it then tries to sync the write\\npointer as it may have been updated by the firmware.\\n\\nIn the unusual event that no packets have been send on TID 0, the queue\\nwill not have been allocated and this causes a crash. Fix this by\\nensuring the queue exist at suspend time.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: iwlwifi: mvm: aseg\u00farese de que exista la cola de descarga TID La ruta del c\u00f3digo de reanudaci\u00f3n supone que se ha configurado la cola de TX para la descarga de TID. En el momento de la reanudaci\u00f3n, intenta sincronizar el puntero de escritura, ya que es posible que el firmware lo haya actualizado. En el caso inusual de que no se hayan enviado paquetes en el TID 0, la cola no se habr\u00e1 asignado y esto provocar\u00e1 una falla. Solucione este problema asegur\u00e1ndose de que la cola exista en el momento de la suspensi\u00f3n.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/intel/iwlwifi/mvm/d3.c\",\"drivers/net/wireless/intel/iwlwifi/mvm/sta.c\",\"drivers/net/wireless/intel/iwlwifi/mvm/sta.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ba7136f3f9e849e5776429317bf45ac3d4cfa3f7\",\"lessThan\":\"4903303f25f48b5a1e34e6324c7fae9ccd6b959a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ba7136f3f9e849e5776429317bf45ac3d4cfa3f7\",\"lessThan\":\"35afffaddbe8d310dc61659da0b1a337b0d0addc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ba7136f3f9e849e5776429317bf45ac3d4cfa3f7\",\"lessThan\":\"ed35a509390ef4011ea2226da5dd6f62b73873b5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ba7136f3f9e849e5776429317bf45ac3d4cfa3f7\",\"lessThan\":\"78f65fbf421a61894c14a1b91fe2fb4437b3fe5f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/intel/iwlwifi/mvm/d3.c\",\"drivers/net/wireless/intel/iwlwifi/mvm/sta.c\",\"drivers/net/wireless/intel/iwlwifi/mvm/sta.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.132\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.85\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.11\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-14T18:56:53.043911Z\",\"id\":\"CVE-2024-27056\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.1.132\",\"matchCriteriaId\":\"5F37CFA2-5A70-4204-9A20-1847146496C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.85\",\"matchCriteriaId\":\"BCB56F36-C998-496A-A2E4-D9E0BB3A5BFC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.11\",\"matchCriteriaId\":\"9B95D3A6-E162-47D5-ABFC-F3FA74FA7CFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A780F817-2A77-4130-A9B7-5C25606314E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"AEB9199B-AB8F-4877-8964-E2BA95B5F15C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/35afffaddbe8d310dc61659da0b1a337b0d0addc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4903303f25f48b5a1e34e6324c7fae9ccd6b959a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/78f65fbf421a61894c14a1b91fe2fb4437b3fe5f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ed35a509390ef4011ea2226da5dd6f62b73873b5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/78f65fbf421a61894c14a1b91fe2fb4437b3fe5f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ed35a509390ef4011ea2226da5dd6f62b73873b5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:06:25+00:00",
      "cve": "CVE-2024-27056",
      "id": "CVE-2024-27056",
      "initial_release_date": "2024-05-01T00:00:00+00:00",
      "product_status:fixed": "429",
      "product_status:known_affected": "136",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: iwlwifi: mvm: ensure offloading TID queue exists",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-27056.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:53:40Z",
      "cve": "CVE-2024-27056",
      "id": "CVE-2024-27056",
      "initial_release_date": "2024-05-04T02:23:08Z",
      "product_status:known_affected": "480",
      "product_status:known_not_affected": "42",
      "product_status:recommended": "696",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-27056",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-27056.json",
      "version": "93"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ed35a509390ef4011ea2226da5dd6f62b73873b5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/78f65fbf421a61894c14a1b91fe2fb4437b3fe5f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T19:29:41.505Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-07-14T12:37:43.339Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-27056\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-14T18:56:53.043911Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-14T18:56:57.318Z\"}}], \"cna\": {\"title\": \"wifi: iwlwifi: mvm: ensure offloading TID queue exists\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The faulting code is only entered through a local system suspend/resume (D3/WoWLAN) cycle initiated on the machine itself; no received frame or network input reaches `iwl_mvm_query_wakeup_reasons()` on its own. An adjacent WiFi actor can shape the precondition and even drive the WoWLAN wake, but the power-management transition is the local entry point.\\nAC:L - The precondition \\u2014 TID 0\u0027s DQA queue never allocated \\u2014 is deterministically reachable by suspending after a fresh (re)association or on a link with no UP-0 uplink traffic, and can be forced outright via a QoS Map that steers all traffic off UP 0. Once that state holds, every resume hits the bug with no race to win.\\nPR:L - An unprivileged local user on a desktop session can request suspend through logind/polkit, and idle autosuspend reaches it with no privileges at all. No CAP_NET_ADMIN or root is needed to trigger the resume path once WoWLAN is configured, which is the normal state on managed laptop fleets and Chromebooks.\\nUI:N - No victim action is required beyond the routine suspend/resume that laptops, tablets and embedded devices perform automatically on idle or lid close. The crash occurs unconditionally in the resume handler.\\nS:U - The out-of-bounds access and the corrupted memory both live in the kernel\u0027s own address space within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - `trans-\u003etxqs.txq[0xFFFF]` reads 8 bytes roughly 512 KB past a 512-entry array \\u2014 an unbounded out-of-bounds read of unrelated kernel heap, not a few-byte bounded overread. The resulting memory corruption is of the class that can be leveraged for kernel memory disclosure.\\nI:H - The out-of-bounds value is dereferenced as a `struct iwl_txq *`, so `spin_lock_bh(\u0026txq-\u003elock)` performs an atomic read-modify-write and `txq-\u003ewrite_ptr`/`read_ptr` store through a kernel pointer the code never validated. That is a write to an out-of-bounds address, i.e. kernel memory corruption of the kind exploitable for control-flow hijacking.\\nA:H - Dereferencing a garbage pointer read from beyond the array reliably oopses during system resume, and taking a bogus spinlock can wedge the resume path entirely. The commit message describes it plainly as \\\"this causes a crash.\\\"\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"ba7136f3f9e849e5776429317bf45ac3d4cfa3f7\", \"lessThan\": \"4903303f25f48b5a1e34e6324c7fae9ccd6b959a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ba7136f3f9e849e5776429317bf45ac3d4cfa3f7\", \"lessThan\": \"35afffaddbe8d310dc61659da0b1a337b0d0addc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ba7136f3f9e849e5776429317bf45ac3d4cfa3f7\", \"lessThan\": \"ed35a509390ef4011ea2226da5dd6f62b73873b5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ba7136f3f9e849e5776429317bf45ac3d4cfa3f7\", \"lessThan\": \"78f65fbf421a61894c14a1b91fe2fb4437b3fe5f\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/wireless/intel/iwlwifi/mvm/d3.c\", \"drivers/net/wireless/intel/iwlwifi/mvm/sta.c\", \"drivers/net/wireless/intel/iwlwifi/mvm/sta.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.132\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.85\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/wireless/intel/iwlwifi/mvm/d3.c\", \"drivers/net/wireless/intel/iwlwifi/mvm/sta.c\", \"drivers/net/wireless/intel/iwlwifi/mvm/sta.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4903303f25f48b5a1e34e6324c7fae9ccd6b959a\"}, {\"url\": \"https://git.kernel.org/stable/c/35afffaddbe8d310dc61659da0b1a337b0d0addc\"}, {\"url\": \"https://git.kernel.org/stable/c/ed35a509390ef4011ea2226da5dd6f62b73873b5\"}, {\"url\": \"https://git.kernel.org/stable/c/78f65fbf421a61894c14a1b91fe2fb4437b3fe5f\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: iwlwifi: mvm: ensure offloading TID queue exists\\n\\nThe resume code path assumes that the TX queue for the offloading TID\\nhas been configured. At resume time it then tries to sync the write\\npointer as it may have been updated by the firmware.\\n\\nIn the unusual event that no packets have been send on TID 0, the queue\\nwill not have been allocated and this causes a crash. Fix this by\\nensuring the queue exist at suspend time.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.132\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.85\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.11\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"5.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:29:16.379Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-27056\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:29:16.379Z\", \"dateReserved\": \"2024-02-19T14:20:24.214Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-01T12:54:56.461Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.