CVE-2024-56663 (GCVE-0-2024-56663)

Vulnerability from cvelistv5 – Published: 2024-12-27 15:06 – Updated: 2026-08-05 11:45
VLAI
Title
wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one Since the netlink attribute range validation provides inclusive checking, the *max* of attribute NL80211_ATTR_MLO_LINK_ID should be IEEE80211_MLD_MAX_NUM_LINKS - 1 otherwise causing an off-by-one. One crash stack for demonstration: ================================================================== BUG: KASAN: wild-memory-access in ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939 Read of size 6 at addr 001102080000000c by task fuzzer.386/9508 CPU: 1 PID: 9508 Comm: syz.1.386 Not tainted 6.1.70 #2 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x177/0x231 lib/dump_stack.c:106 print_report+0xe0/0x750 mm/kasan/report.c:398 kasan_report+0x139/0x170 mm/kasan/report.c:495 kasan_check_range+0x287/0x290 mm/kasan/generic.c:189 memcpy+0x25/0x60 mm/kasan/shadow.c:65 ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939 rdev_tx_control_port net/wireless/rdev-ops.h:761 [inline] nl80211_tx_control_port+0x7b3/0xc40 net/wireless/nl80211.c:15453 genl_family_rcv_msg_doit+0x22e/0x320 net/netlink/genetlink.c:756 genl_family_rcv_msg net/netlink/genetlink.c:833 [inline] genl_rcv_msg+0x539/0x740 net/netlink/genetlink.c:850 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2508 genl_rcv+0x24/0x40 net/netlink/genetlink.c:861 netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline] netlink_unicast+0x74b/0x8c0 net/netlink/af_netlink.c:1352 netlink_sendmsg+0x882/0xb90 net/netlink/af_netlink.c:1874 sock_sendmsg_nosec net/socket.c:716 [inline] __sock_sendmsg net/socket.c:728 [inline] ____sys_sendmsg+0x5cc/0x8f0 net/socket.c:2499 ___sys_sendmsg+0x21c/0x290 net/socket.c:2553 __sys_sendmsg net/socket.c:2582 [inline] __do_sys_sendmsg net/socket.c:2591 [inline] __se_sys_sendmsg+0x19e/0x270 net/socket.c:2589 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x45/0x90 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd Update the policy to ensure correct validation.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7b0a0e3c3a88260b6fcb017e49f198463aa62ed1 , < 29e640ae641b9f5ffc666049426d2b16c98d9963 (git)
Affected: 7b0a0e3c3a88260b6fcb017e49f198463aa62ed1 , < f3412522f78826fef1dfae40ef378a863df2591c (git)
Affected: 7b0a0e3c3a88260b6fcb017e49f198463aa62ed1 , < f850d1d9f1106f528dfc5807565f2d1fa9a397d3 (git)
Affected: 7b0a0e3c3a88260b6fcb017e49f198463aa62ed1 , < 2e3dbf938656986cce73ac4083500d0bcfbffe24 (git)
Affected: 7a53ad13c09150076b7ddde96c2dfc5622c90b45 (git)
Affected: 5.19.2 , < 5.20 (semver)
Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.1.121 , ≤ 6.1.* (semver)
Unaffected: 6.6.67 , ≤ 6.6.* (semver)
Unaffected: 6.12.6 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56663",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:59:54.860579Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-193",
                "description": "CWE-193 Off-by-one Error",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:07:09.931Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:52:11.640Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/nl80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "29e640ae641b9f5ffc666049426d2b16c98d9963",
              "status": "affected",
              "version": "7b0a0e3c3a88260b6fcb017e49f198463aa62ed1",
              "versionType": "git"
            },
            {
              "lessThan": "f3412522f78826fef1dfae40ef378a863df2591c",
              "status": "affected",
              "version": "7b0a0e3c3a88260b6fcb017e49f198463aa62ed1",
              "versionType": "git"
            },
            {
              "lessThan": "f850d1d9f1106f528dfc5807565f2d1fa9a397d3",
              "status": "affected",
              "version": "7b0a0e3c3a88260b6fcb017e49f198463aa62ed1",
              "versionType": "git"
            },
            {
              "lessThan": "2e3dbf938656986cce73ac4083500d0bcfbffe24",
              "status": "affected",
              "version": "7b0a0e3c3a88260b6fcb017e49f198463aa62ed1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7a53ad13c09150076b7ddde96c2dfc5622c90b45",
              "versionType": "git"
            },
            {
              "lessThan": "5.20",
              "status": "affected",
              "version": "5.19.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/nl80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.67",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.121",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.67",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.6",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.19.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one\n\nSince the netlink attribute range validation provides inclusive\nchecking, the *max* of attribute NL80211_ATTR_MLO_LINK_ID should be\nIEEE80211_MLD_MAX_NUM_LINKS - 1 otherwise causing an off-by-one.\n\nOne crash stack for demonstration:\n==================================================================\nBUG: KASAN: wild-memory-access in ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939\nRead of size 6 at addr 001102080000000c by task fuzzer.386/9508\n\nCPU: 1 PID: 9508 Comm: syz.1.386 Not tainted 6.1.70 #2\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x177/0x231 lib/dump_stack.c:106\n print_report+0xe0/0x750 mm/kasan/report.c:398\n kasan_report+0x139/0x170 mm/kasan/report.c:495\n kasan_check_range+0x287/0x290 mm/kasan/generic.c:189\n memcpy+0x25/0x60 mm/kasan/shadow.c:65\n ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939\n rdev_tx_control_port net/wireless/rdev-ops.h:761 [inline]\n nl80211_tx_control_port+0x7b3/0xc40 net/wireless/nl80211.c:15453\n genl_family_rcv_msg_doit+0x22e/0x320 net/netlink/genetlink.c:756\n genl_family_rcv_msg net/netlink/genetlink.c:833 [inline]\n genl_rcv_msg+0x539/0x740 net/netlink/genetlink.c:850\n netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2508\n genl_rcv+0x24/0x40 net/netlink/genetlink.c:861\n netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline]\n netlink_unicast+0x74b/0x8c0 net/netlink/af_netlink.c:1352\n netlink_sendmsg+0x882/0xb90 net/netlink/af_netlink.c:1874\n sock_sendmsg_nosec net/socket.c:716 [inline]\n __sock_sendmsg net/socket.c:728 [inline]\n ____sys_sendmsg+0x5cc/0x8f0 net/socket.c:2499\n ___sys_sendmsg+0x21c/0x290 net/socket.c:2553\n __sys_sendmsg net/socket.c:2582 [inline]\n __do_sys_sendmsg net/socket.c:2591 [inline]\n __se_sys_sendmsg+0x19e/0x270 net/socket.c:2589\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x45/0x90 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nUpdate the policy to ensure correct validation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered by sending a crafted generic-netlink message (NL80211_CMD_CONTROL_PORT_FRAME / NL80211_CMD_ADD_LINK) with NL80211_ATTR_MLO_LINK_ID=15 via sendmsg() on an AF_NETLINK socket. No network traffic or radio proximity is involved in reaching the flaw.\nAC:L - A single netlink message with the out-of-range link ID deterministically reaches the off-by-one; there is no race and no condition outside the attacker\u0027s control. The attacker additionally controls the bytes adjacent to the arrays (interface MAC and link bitmaps), so the bogus pointer value and the OOB-written data are chosen, not incidental.\nPR:L - The affected nl80211 ops use GENL_UNS_ADMIN_PERM, i.e. CAP_NET_ADMIN in the user namespace owning the netns, which an unprivileged user obtains with `unshare -Urn`; mac80211_hwsim\u0027s NEW_RADIO is gated identically and creates an MLO-capable wiphy directly in the caller\u0027s netns. No real root in the init namespace is required.\nUI:N - The attacker performs the entire sequence itself via netlink syscalls on an interface it controls. No victim action is needed.\nS:U - The out-of-bounds accesses and resulting corruption are confined to kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - ieee80211_tx_control_port() dereferences an attacker-composed pointer (built from the settable interface MAC and link bitmaps) and copies 6 bytes of kernel memory into the source MAC of a frame that is then transmitted, giving a repeatable, attacker-directed kernel memory disclosure primitive.\nI:H - nl80211_add_link() performs a 6-byte fully attacker-controlled out-of-bounds write over wireless_dev.valid_links/radio_mask, and setting bit 15 in valid_links bypasses the NL80211_FLAG_MLO_VALID_LINK_ID checks so further handlers write chandef/beacon_interval data tens of bytes past struct wireless_dev into struct ieee80211_sub_if_data.\nA:H - The demonstrated syzkaller crash is a wild-pointer dereference (KASAN wild-memory-access) causing an oops/GPF, and the corrupted state leaves sdata-\u003elink[0]/link_conf[0] NULL with valid_links=BIT(15), so subsequent wireless operations panic the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:45:57.378Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/29e640ae641b9f5ffc666049426d2b16c98d9963"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3412522f78826fef1dfae40ef378a863df2591c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f850d1d9f1106f528dfc5807565f2d1fa9a397d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e3dbf938656986cce73ac4083500d0bcfbffe24"
        }
      ],
      "title": "wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56663",
    "datePublished": "2024-12-27T15:06:25.403Z",
    "dateReserved": "2024-12-27T15:00:39.843Z",
    "dateUpdated": "2026-08-05T11:45:57.378Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56663",
      "date": "2026-08-05",
      "epss": "0.00228",
      "percentile": "0.1368"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.19.2\", \"versionEndExcluding\": \"5.20\", \"matchCriteriaId\": \"E8D3E719-D0A1-4044-AB60-B63044B0A1B3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.0\", \"versionEndExcluding\": \"6.1.121\", \"matchCriteriaId\": \"46F9451D-F254-4A6D-A0CE-93AC2EF2FC98\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.67\", \"matchCriteriaId\": \"BF4F2CD1-2CA6-4D6B-9B0C-57C3C4D6544A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.12.6\", \"matchCriteriaId\": \"0CB1A9BB-F95E-43DD-A2FD-147912FD91E5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one\\n\\nSince the netlink attribute range validation provides inclusive\\nchecking, the *max* of attribute NL80211_ATTR_MLO_LINK_ID should be\\nIEEE80211_MLD_MAX_NUM_LINKS - 1 otherwise causing an off-by-one.\\n\\nOne crash stack for demonstration:\\n==================================================================\\nBUG: KASAN: wild-memory-access in ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939\\nRead of size 6 at addr 001102080000000c by task fuzzer.386/9508\\n\\nCPU: 1 PID: 9508 Comm: syz.1.386 Not tainted 6.1.70 #2\\nCall Trace:\\n \u003cTASK\u003e\\n __dump_stack lib/dump_stack.c:88 [inline]\\n dump_stack_lvl+0x177/0x231 lib/dump_stack.c:106\\n print_report+0xe0/0x750 mm/kasan/report.c:398\\n kasan_report+0x139/0x170 mm/kasan/report.c:495\\n kasan_check_range+0x287/0x290 mm/kasan/generic.c:189\\n memcpy+0x25/0x60 mm/kasan/shadow.c:65\\n ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939\\n rdev_tx_control_port net/wireless/rdev-ops.h:761 [inline]\\n nl80211_tx_control_port+0x7b3/0xc40 net/wireless/nl80211.c:15453\\n genl_family_rcv_msg_doit+0x22e/0x320 net/netlink/genetlink.c:756\\n genl_family_rcv_msg net/netlink/genetlink.c:833 [inline]\\n genl_rcv_msg+0x539/0x740 net/netlink/genetlink.c:850\\n netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2508\\n genl_rcv+0x24/0x40 net/netlink/genetlink.c:861\\n netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline]\\n netlink_unicast+0x74b/0x8c0 net/netlink/af_netlink.c:1352\\n netlink_sendmsg+0x882/0xb90 net/netlink/af_netlink.c:1874\\n sock_sendmsg_nosec net/socket.c:716 [inline]\\n __sock_sendmsg net/socket.c:728 [inline]\\n ____sys_sendmsg+0x5cc/0x8f0 net/socket.c:2499\\n ___sys_sendmsg+0x21c/0x290 net/socket.c:2553\\n __sys_sendmsg net/socket.c:2582 [inline]\\n __do_sys_sendmsg net/socket.c:2591 [inline]\\n __se_sys_sendmsg+0x19e/0x270 net/socket.c:2589\\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\\n do_syscall_64+0x45/0x90 arch/x86/entry/common.c:81\\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\\n\\nUpdate the policy to ensure correct validation.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: nl80211: correcci\\u00f3n del error NL80211_ATTR_MLO_LINK_ID en uno Dado que la validaci\\u00f3n del rango del atributo netlink proporciona una verificaci\\u00f3n inclusiva, el *m\\u00e1ximo* del atributo NL80211_ATTR_MLO_LINK_ID debe ser IEEE80211_MLD_MAX_NUM_LINKS - 1, lo que de lo contrario provocar\\u00eda un error de uno. Una pila de fallos para demostraci\\u00f3n: ==================================================================== ERROR: KASAN: acceso a memoria salvaje en ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939 Lectura de tama\\u00f1o 6 en la direcci\\u00f3n 001102080000000c por la tarea fuzzer.386/9508 CPU: 1 PID: 9508 Comm: syz.1.386 No contaminado 6.1.70 #2 Seguimiento de llamadas:  __dump_stack lib/dump_stack.c:88 [en l\\u00ednea] dump_stack_lvl+0x177/0x231 lib/dump_stack.c:106 print_report+0xe0/0x750 mm/kasan/report.c:398 kasan_report+0x139/0x170 mm/kasan/report.c:495 kasan_check_range+0x287/0x290 mm/kasan/generic.c:189 memcpy+0x25/0x60 mm/kasan/shadow.c:65 ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939 rdev_tx_control_port net/wireless/rdev-ops.h:761 [en l\\u00ednea] nl80211_tx_control_port+0x7b3/0xc40 net/wireless/nl80211.c:15453 genl_family_rcv_msg_doit+0x22e/0x320 net/netlink/genetlink.c:756 genl_family_rcv_msg net/netlink/genetlink.c:833 [en l\\u00ednea] genl_rcv_msg+0x539/0x740 net/netlink/genetlink.c:850 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2508 genl_rcv+0x24/0x40 net/netlink/genetlink.c:861 netlink_unicast_kernel net/netlink/af_netlink.c:1326 [en l\\u00ednea] netlink_unicast+0x74b/0x8c0 net/netlink/af_netlink.c:1352 netlink_sendmsg+0x882/0xb90 net/netlink/af_netlink.c:1874 sock_sendmsg_nosec net/socket.c:716 [en l\\u00ednea] __sock_sendmsg net/socket.c:728 [en l\\u00ednea] ____sys_sendmsg+0x5cc/0x8f0 net/socket.c:2499 ___sys_sendmsg+0x21c/0x290 net/socket.c:2553 __sys_sendmsg net/socket.c:2582 [en l\\u00ednea] __do_sys_sendmsg net/socket.c:2591 [en l\\u00ednea] __se_sys_sendmsg+0x19e/0x270 net/socket.c:2589 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x45/0x90 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd Actualice la pol\\u00edtica para garantizar una validaci\\u00f3n correcta.\"}]",
      "id": "CVE-2024-56663",
      "lastModified": "2025-01-06T18:52:41.737",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.2}]}",
      "published": "2024-12-27T15:15:26.187",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/29e640ae641b9f5ffc666049426d2b16c98d9963\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/2e3dbf938656986cce73ac4083500d0bcfbffe24\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f3412522f78826fef1dfae40ef378a863df2591c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f850d1d9f1106f528dfc5807565f2d1fa9a397d3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-193\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-19T01:43:40.000Z",
      "cve": "CVE-2024-56663",
      "id": "msrc_CVE-2024-56663",
      "initial_release_date": "2024-12-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-56663.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56663\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:26.187\",\"lastModified\":\"2026-08-04T11:22:19.773\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one\\n\\nSince the netlink attribute range validation provides inclusive\\nchecking, the *max* of attribute NL80211_ATTR_MLO_LINK_ID should be\\nIEEE80211_MLD_MAX_NUM_LINKS - 1 otherwise causing an off-by-one.\\n\\nOne crash stack for demonstration:\\n==================================================================\\nBUG: KASAN: wild-memory-access in ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939\\nRead of size 6 at addr 001102080000000c by task fuzzer.386/9508\\n\\nCPU: 1 PID: 9508 Comm: syz.1.386 Not tainted 6.1.70 #2\\nCall Trace:\\n \u003cTASK\u003e\\n __dump_stack lib/dump_stack.c:88 [inline]\\n dump_stack_lvl+0x177/0x231 lib/dump_stack.c:106\\n print_report+0xe0/0x750 mm/kasan/report.c:398\\n kasan_report+0x139/0x170 mm/kasan/report.c:495\\n kasan_check_range+0x287/0x290 mm/kasan/generic.c:189\\n memcpy+0x25/0x60 mm/kasan/shadow.c:65\\n ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939\\n rdev_tx_control_port net/wireless/rdev-ops.h:761 [inline]\\n nl80211_tx_control_port+0x7b3/0xc40 net/wireless/nl80211.c:15453\\n genl_family_rcv_msg_doit+0x22e/0x320 net/netlink/genetlink.c:756\\n genl_family_rcv_msg net/netlink/genetlink.c:833 [inline]\\n genl_rcv_msg+0x539/0x740 net/netlink/genetlink.c:850\\n netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2508\\n genl_rcv+0x24/0x40 net/netlink/genetlink.c:861\\n netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline]\\n netlink_unicast+0x74b/0x8c0 net/netlink/af_netlink.c:1352\\n netlink_sendmsg+0x882/0xb90 net/netlink/af_netlink.c:1874\\n sock_sendmsg_nosec net/socket.c:716 [inline]\\n __sock_sendmsg net/socket.c:728 [inline]\\n ____sys_sendmsg+0x5cc/0x8f0 net/socket.c:2499\\n ___sys_sendmsg+0x21c/0x290 net/socket.c:2553\\n __sys_sendmsg net/socket.c:2582 [inline]\\n __do_sys_sendmsg net/socket.c:2591 [inline]\\n __se_sys_sendmsg+0x19e/0x270 net/socket.c:2589\\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\\n do_syscall_64+0x45/0x90 arch/x86/entry/common.c:81\\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\\n\\nUpdate the policy to ensure correct validation.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: nl80211: correcci\u00f3n del error NL80211_ATTR_MLO_LINK_ID en uno Dado que la validaci\u00f3n del rango del atributo netlink proporciona una verificaci\u00f3n inclusiva, el *m\u00e1ximo* del atributo NL80211_ATTR_MLO_LINK_ID debe ser IEEE80211_MLD_MAX_NUM_LINKS - 1, lo que de lo contrario provocar\u00eda un error de uno. Una pila de fallos para demostraci\u00f3n: ==================================================================== ERROR: KASAN: acceso a memoria salvaje en ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939 Lectura de tama\u00f1o 6 en la direcci\u00f3n 001102080000000c por la tarea fuzzer.386/9508 CPU: 1 PID: 9508 Comm: syz.1.386 No contaminado 6.1.70 #2 Seguimiento de llamadas:  __dump_stack lib/dump_stack.c:88 [en l\u00ednea] dump_stack_lvl+0x177/0x231 lib/dump_stack.c:106 print_report+0xe0/0x750 mm/kasan/report.c:398 kasan_report+0x139/0x170 mm/kasan/report.c:495 kasan_check_range+0x287/0x290 mm/kasan/generic.c:189 memcpy+0x25/0x60 mm/kasan/shadow.c:65 ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939 rdev_tx_control_port net/wireless/rdev-ops.h:761 [en l\u00ednea] nl80211_tx_control_port+0x7b3/0xc40 net/wireless/nl80211.c:15453 genl_family_rcv_msg_doit+0x22e/0x320 net/netlink/genetlink.c:756 genl_family_rcv_msg net/netlink/genetlink.c:833 [en l\u00ednea] genl_rcv_msg+0x539/0x740 net/netlink/genetlink.c:850 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2508 genl_rcv+0x24/0x40 net/netlink/genetlink.c:861 netlink_unicast_kernel net/netlink/af_netlink.c:1326 [en l\u00ednea] netlink_unicast+0x74b/0x8c0 net/netlink/af_netlink.c:1352 netlink_sendmsg+0x882/0xb90 net/netlink/af_netlink.c:1874 sock_sendmsg_nosec net/socket.c:716 [en l\u00ednea] __sock_sendmsg net/socket.c:728 [en l\u00ednea] ____sys_sendmsg+0x5cc/0x8f0 net/socket.c:2499 ___sys_sendmsg+0x21c/0x290 net/socket.c:2553 __sys_sendmsg net/socket.c:2582 [en l\u00ednea] __do_sys_sendmsg net/socket.c:2591 [en l\u00ednea] __se_sys_sendmsg+0x19e/0x270 net/socket.c:2589 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x45/0x90 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd Actualice la pol\u00edtica para garantizar una validaci\u00f3n correcta.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/wireless/nl80211.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7b0a0e3c3a88260b6fcb017e49f198463aa62ed1\",\"lessThan\":\"29e640ae641b9f5ffc666049426d2b16c98d9963\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7b0a0e3c3a88260b6fcb017e49f198463aa62ed1\",\"lessThan\":\"f3412522f78826fef1dfae40ef378a863df2591c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7b0a0e3c3a88260b6fcb017e49f198463aa62ed1\",\"lessThan\":\"f850d1d9f1106f528dfc5807565f2d1fa9a397d3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7b0a0e3c3a88260b6fcb017e49f198463aa62ed1\",\"lessThan\":\"2e3dbf938656986cce73ac4083500d0bcfbffe24\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7a53ad13c09150076b7ddde96c2dfc5622c90b45\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.19.2\",\"lessThan\":\"5.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/wireless/nl80211.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.121\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.67\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.6\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:59:54.860579Z\",\"id\":\"CVE-2024-56663\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-193\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-193\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19.2\",\"versionEndExcluding\":\"5.20\",\"matchCriteriaId\":\"E8D3E719-D0A1-4044-AB60-B63044B0A1B3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0\",\"versionEndExcluding\":\"6.1.121\",\"matchCriteriaId\":\"46F9451D-F254-4A6D-A0CE-93AC2EF2FC98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.67\",\"matchCriteriaId\":\"BF4F2CD1-2CA6-4D6B-9B0C-57C3C4D6544A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.6\",\"matchCriteriaId\":\"0CB1A9BB-F95E-43DD-A2FD-147912FD91E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/29e640ae641b9f5ffc666049426d2b16c98d9963\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2e3dbf938656986cce73ac4083500d0bcfbffe24\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f3412522f78826fef1dfae40ef378a863df2591c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f850d1d9f1106f528dfc5807565f2d1fa9a397d3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T14:06:39+00:00",
      "cve": "CVE-2024-56663",
      "id": "CVE-2024-56663",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "112",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56663.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:17:26Z",
      "cve": "CVE-2024-56663",
      "id": "CVE-2024-56663",
      "initial_release_date": "2025-01-10T00:21:26Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "365",
      "product_status:recommended": "406",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-56663",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-56663.json",
      "version": "56"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:52:11.640Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-56663\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:59:54.860579Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-193\", \"description\": \"CWE-193 Off-by-one Error\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:45:25.508Z\"}}], \"cna\": {\"title\": \"wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is triggered by sending a crafted generic-netlink message (NL80211_CMD_CONTROL_PORT_FRAME / NL80211_CMD_ADD_LINK) with NL80211_ATTR_MLO_LINK_ID=15 via sendmsg() on an AF_NETLINK socket. No network traffic or radio proximity is involved in reaching the flaw.\\nAC:L - A single netlink message with the out-of-range link ID deterministically reaches the off-by-one; there is no race and no condition outside the attacker\u0027s control. The attacker additionally controls the bytes adjacent to the arrays (interface MAC and link bitmaps), so the bogus pointer value and the OOB-written data are chosen, not incidental.\\nPR:L - The affected nl80211 ops use GENL_UNS_ADMIN_PERM, i.e. CAP_NET_ADMIN in the user namespace owning the netns, which an unprivileged user obtains with `unshare -Urn`; mac80211_hwsim\u0027s NEW_RADIO is gated identically and creates an MLO-capable wiphy directly in the caller\u0027s netns. No real root in the init namespace is required.\\nUI:N - The attacker performs the entire sequence itself via netlink syscalls on an interface it controls. No victim action is needed.\\nS:U - The out-of-bounds accesses and resulting corruption are confined to kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - ieee80211_tx_control_port() dereferences an attacker-composed pointer (built from the settable interface MAC and link bitmaps) and copies 6 bytes of kernel memory into the source MAC of a frame that is then transmitted, giving a repeatable, attacker-directed kernel memory disclosure primitive.\\nI:H - nl80211_add_link() performs a 6-byte fully attacker-controlled out-of-bounds write over wireless_dev.valid_links/radio_mask, and setting bit 15 in valid_links bypasses the NL80211_FLAG_MLO_VALID_LINK_ID checks so further handlers write chandef/beacon_interval data tens of bytes past struct wireless_dev into struct ieee80211_sub_if_data.\\nA:H - The demonstrated syzkaller crash is a wild-pointer dereference (KASAN wild-memory-access) causing an oops/GPF, and the corrupted state leaves sdata-\u003elink[0]/link_conf[0] NULL with valid_links=BIT(15), so subsequent wireless operations panic the kernel.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7b0a0e3c3a88260b6fcb017e49f198463aa62ed1\", \"lessThan\": \"29e640ae641b9f5ffc666049426d2b16c98d9963\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7b0a0e3c3a88260b6fcb017e49f198463aa62ed1\", \"lessThan\": \"f3412522f78826fef1dfae40ef378a863df2591c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7b0a0e3c3a88260b6fcb017e49f198463aa62ed1\", \"lessThan\": \"f850d1d9f1106f528dfc5807565f2d1fa9a397d3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7b0a0e3c3a88260b6fcb017e49f198463aa62ed1\", \"lessThan\": \"2e3dbf938656986cce73ac4083500d0bcfbffe24\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7a53ad13c09150076b7ddde96c2dfc5622c90b45\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.19.2\", \"lessThan\": \"5.20\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/wireless/nl80211.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.121\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.67\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/wireless/nl80211.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/29e640ae641b9f5ffc666049426d2b16c98d9963\"}, {\"url\": \"https://git.kernel.org/stable/c/f3412522f78826fef1dfae40ef378a863df2591c\"}, {\"url\": \"https://git.kernel.org/stable/c/f850d1d9f1106f528dfc5807565f2d1fa9a397d3\"}, {\"url\": \"https://git.kernel.org/stable/c/2e3dbf938656986cce73ac4083500d0bcfbffe24\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one\\n\\nSince the netlink attribute range validation provides inclusive\\nchecking, the *max* of attribute NL80211_ATTR_MLO_LINK_ID should be\\nIEEE80211_MLD_MAX_NUM_LINKS - 1 otherwise causing an off-by-one.\\n\\nOne crash stack for demonstration:\\n==================================================================\\nBUG: KASAN: wild-memory-access in ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939\\nRead of size 6 at addr 001102080000000c by task fuzzer.386/9508\\n\\nCPU: 1 PID: 9508 Comm: syz.1.386 Not tainted 6.1.70 #2\\nCall Trace:\\n \u003cTASK\u003e\\n __dump_stack lib/dump_stack.c:88 [inline]\\n dump_stack_lvl+0x177/0x231 lib/dump_stack.c:106\\n print_report+0xe0/0x750 mm/kasan/report.c:398\\n kasan_report+0x139/0x170 mm/kasan/report.c:495\\n kasan_check_range+0x287/0x290 mm/kasan/generic.c:189\\n memcpy+0x25/0x60 mm/kasan/shadow.c:65\\n ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939\\n rdev_tx_control_port net/wireless/rdev-ops.h:761 [inline]\\n nl80211_tx_control_port+0x7b3/0xc40 net/wireless/nl80211.c:15453\\n genl_family_rcv_msg_doit+0x22e/0x320 net/netlink/genetlink.c:756\\n genl_family_rcv_msg net/netlink/genetlink.c:833 [inline]\\n genl_rcv_msg+0x539/0x740 net/netlink/genetlink.c:850\\n netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2508\\n genl_rcv+0x24/0x40 net/netlink/genetlink.c:861\\n netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline]\\n netlink_unicast+0x74b/0x8c0 net/netlink/af_netlink.c:1352\\n netlink_sendmsg+0x882/0xb90 net/netlink/af_netlink.c:1874\\n sock_sendmsg_nosec net/socket.c:716 [inline]\\n __sock_sendmsg net/socket.c:728 [inline]\\n ____sys_sendmsg+0x5cc/0x8f0 net/socket.c:2499\\n ___sys_sendmsg+0x21c/0x290 net/socket.c:2553\\n __sys_sendmsg net/socket.c:2582 [inline]\\n __do_sys_sendmsg net/socket.c:2591 [inline]\\n __se_sys_sendmsg+0x19e/0x270 net/socket.c:2589\\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\\n do_syscall_64+0x45/0x90 arch/x86/entry/common.c:81\\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\\n\\nUpdate the policy to ensure correct validation.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.121\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.67\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.6\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.19.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:45:57.378Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-56663\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:45:57.378Z\", \"dateReserved\": \"2024-12-27T15:00:39.843Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-27T15:06:25.403Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.