Riskcovery

CVE-2024-53055

wifi: iwlwifi: mvm: fix 6 GHz scan construction

State
Published
Severity
5.5 Medium
Published
Nov 19, 2024
Updated
May 11, 2026
Reserved
Nov 19, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix 6 GHz scan construction

If more than 255 colocated APs exist for the set of all APs found during 2.4/5 GHz scanning, then the 6 GHz scan construction will loop forever since the loop variable has type u8, which can never reach the number found when that's bigger than 255, and is stored in a u32 variable. Also move it into the loops to have a smaller scope.

Using a u32 there is fine, we limit the number of APs in the scan list and each has a limit on the number of RNR entries due to the frame size. With a limit of 1000 scan results, a frame size upper bound of 4096 (really it's more like ~2300) and a TBTT entry size of at least 11, we get an upper bound for the number of ~372k, well in the bounds of a u32.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

  • CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

Affected Products

ProductVersions
LinuxLinux
  • eae94cf82d7456b57fa9fd55c1edb8a726dcc19c to before 2ac15e5a8f42fed5d90ed9e1197600913678c50fAffected
  • eae94cf82d7456b57fa9fd55c1edb8a726dcc19c to before cde8a7eb5c6762264ff0f4433358e0a0d250c875Affected
  • eae94cf82d7456b57fa9fd55c1edb8a726dcc19c to before fc621e7a043de346c33bd7ae7e2e0c651d6152efAffected
  • eae94cf82d7456b57fa9fd55c1edb8a726dcc19c to before 2ccd5badadab2d586e91546bf5af3deda07fef1fAffected
  • eae94cf82d7456b57fa9fd55c1edb8a726dcc19c to before 7245012f0f496162dd95d888ed2ceb5a35170f1aAffected
LinuxLinux
  • 5.11Affected
  • before 5.11Not affected
  • 5.15.171 through 5.15.*Not affected
  • 6.1.116 through 6.1.*Not affected
  • 6.6.60 through 6.6.*Not affected
  • 6.11.7 through 6.11.*Not affected
  • 6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.