CyberSecBulletin
CVE-2024-43881NVD status: Modified

Linux: Exposure of Resource to Wrong Sphere

Published Updated By the CyberSecBulletin desk

CVE-2024-43881 is a high-severity exposure of resource to wrong sphere vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions e99d9b16ff153de9540073239d24adc3b0a3a997, 6925320fcd40d8042d32bf4ede8248e7a5315c3b, 33322e3ef07409278a18c6919c448e369d66a18e as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.31% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to e99d9b16ff153de9540073239d24adc3b0a3a997 or 6925320fcd40d8042d32bf4ede8248e7a5315c3b or 33322e3ef07409278a18c6919c448e369d66a18e, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.6.44 or 6.10.3, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxd889913205cf7ebda905b1e62c5867ed4e39f6c2 up to, but not including, e99d9b16ff153de9540073239d24adc3b0a3a997; d889913205cf7ebda905b1e62c5867ed4e39f6c2 up to, but not including, 6925320fcd40d8042d32bf4ede8248e7a5315c3b; d889913205cf7ebda905b1e62c5867ed4e39f6c2 up to, but not including, 33322e3ef07409278a18c6919c448e369d66a18e; 6.3e99d9b16ff153de9540073239d24adc3b0a3a997, 6925320fcd40d8042d32bf4ede8248e7a5315c3b, 33322e3ef07409278a18c6919c448e369d66a18e
LinuxLinux Kernel6.3 up to, but not including, 6.6.44; 6.7 up to, but not including, 6.10.36.6.44, 6.10.3

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.18.8HighCNA
CVSS 3.17.1HighNVD

Official description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: change DMA direction while mapping reinjected packets For fragmented packets, ath12k reassembles each fragment as a normal packet and then reinjects it into HW ring. In this case, the DMA direction should be DMA_TO_DEVICE, not DMA_FROM_DEVICE. Otherwise, an invalid payload may be reinjected into the HW and subsequently delivered to the host. Given that arbitrary memory can be allocated to the skb buffer, knowledge about the data contained in the reinjected buffer is lacking. Consequently, there’s a risk of private information being leaked. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

More Exposure of Resource to Wrong Sphere vulnerabilities (CWE-668)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Exposure of Resource to Wrong Sphere vulnerabilities

Spotted an error? Tell us.