Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

Linux Wi-Fi Driver Vulnerability: Data Leak and Crash Risk

CVE-2024-49857 · published 2 years ago
Summary

A bug in the Linux Wi-Fi driver could allow attackers to access sensitive information or crash the system. This issue has been fixed in the latest Linux kernel update. Update your Linux system to the latest version to prevent potential data exposure and system crashes.

What to do
  • Update linux kernel to version 6.11.2.
  • Update linux linux_kernel to version 6.11.2 or later.
  • Update linux linux to version b3322a6d6aa9bc17b395c4b38d3b97578887aa8a or later.
Affected software
Ecosystem VendorProductAffected versions
– linux linux_kernel >= 6.11, < 6.11.2
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
– linux linux < b3322a6d6aa9bc17b395c4b38d3b97578887aa8a
6.11
Linux linux kernel >= 6.11.0, < 6.11.2
Fix: upgrade to 6.11.2
Original advisory text
wifi: iwlwifi: mvm: set the cipher for secured NDP ranging
In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: set the cipher for secured NDP ranging

The cipher pointer is not set, but is derefereced trying to set its
content, which leads to a NULL pointer dereference.
Fix it by pointing to the cipher parameter before dereferencing.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-476NULL Pointer Dereference
Timeline
Published21 Oct 2024
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-49857 · OSV
CVE-2024-49857 · NVD
CVE-2024-49857 · MITRE
Track software like this
Free during beta