CVE-2024-38572
📋 TL;DR
This vulnerability in the Linux kernel's ath12k WiFi driver allows out-of-bounds memory access when processing QMI messages, potentially leading to kernel crashes or arbitrary code execution. It affects Linux systems using vulnerable versions of the ath12k driver, particularly those with Qualcomm QCN9274 WiFi hardware. The issue occurs due to a missing terminator entry in a message handler array.
💻 Affected Systems
- Linux kernel ath12k WiFi driver
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to system crash, or potential kernel-level arbitrary code execution with root privileges.
Likely Case
System instability, kernel crashes, or denial of service when processing specific QMI messages.
If Mitigated
Limited to kernel crashes if exploit attempts fail or are contained by kernel protections.
🎯 Exploit Status
Exploitation requires sending crafted QMI messages to trigger the out-of-bounds access. No public exploit code identified, but the vulnerability is well-documented in kernel commits.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Multiple stable kernel versions with commits: 95575de7dede7b1ed3b9718dab9dda97914ea775, a1abdb63628b04855a929850772de97435ed1555, b48d40f5840c505b7af700594aa8379eec28e925, e1bdff48a1bb4a4ac660c19c55a820968c48b3f2
Vendor Advisory: https://git.kernel.org/stable/c/95575de7dede7b1ed3b9718dab9dda97914ea775
Restart Required: Yes
Instructions:
1. Update Linux kernel to a patched version containing the fix commits. 2. Reboot system to load new kernel. 3. Verify ath12k driver is updated.
🔧 Temporary Workarounds
Disable ath12k driver
linuxUnload the vulnerable ath12k driver if not required
sudo modprobe -r ath12k
Blacklist ath12k module
linuxPrevent ath12k driver from loading at boot
echo 'blacklist ath12k' | sudo tee /etc/modprobe.d/ath12k-blacklist.conf
sudo update-initramfs -u
🧯 If You Can't Patch
- Restrict network access to WiFi interfaces using firewalls
- Monitor system logs for kernel panic or KASAN warnings related to ath12k
🔍 How to Verify
Check if Vulnerable:
Check if ath12k module is loaded: lsmod | grep ath12k. Check kernel version and whether it contains the fix commits.Check Version:
uname -rVerify Fix Applied:
Verify kernel version includes fix commits. Check dmesg for absence of KASAN warnings related to ath12k_qmi_msg_handlers.📡 Detection & Monitoring
Log Indicators:
- KASAN warnings mentioning ath12k_qmi_msg_handlers
- Kernel panic logs
- Out-of-bounds access errors in kernel logs
Network Indicators:
- Unusual QMI message traffic to WiFi interfaces
SIEM Query:
source="kernel" AND ("ath12k" OR "KASAN" OR "out-of-bounds")🔗 References
- https://git.kernel.org/stable/c/95575de7dede7b1ed3b9718dab9dda97914ea775
- https://git.kernel.org/stable/c/a1abdb63628b04855a929850772de97435ed1555
- https://git.kernel.org/stable/c/b48d40f5840c505b7af700594aa8379eec28e925
- https://git.kernel.org/stable/c/e1bdff48a1bb4a4ac660c19c55a820968c48b3f2
- https://git.kernel.org/stable/c/95575de7dede7b1ed3b9718dab9dda97914ea775
- https://git.kernel.org/stable/c/a1abdb63628b04855a929850772de97435ed1555
- https://git.kernel.org/stable/c/b48d40f5840c505b7af700594aa8379eec28e925
- https://git.kernel.org/stable/c/e1bdff48a1bb4a4ac660c19c55a820968c48b3f2
