CVE-2024-47721
📋 TL;DR
This vulnerability in the Linux kernel's rtw89 WiFi driver allows out-of-bounds memory access when processing certain firmware events. It affects systems using Realtek rtw89 WiFi chips with unpatched kernel versions, potentially leading to system crashes or information disclosure.
💻 Affected Systems
- Linux kernel with rtw89 WiFi driver
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to system crash, or potential information disclosure from kernel memory
Likely Case
System instability or crashes when specific WiFi events are triggered
If Mitigated
No impact if patched or if affected driver not loaded
🎯 Exploit Status
Requires ability to trigger specific WiFi C2H events
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions containing commits 10463308b945, 2c9c2d1a2091, or 56310ddb50b1
Vendor Advisory: https://git.kernel.org/stable/c/10463308b9454f534d03300cf679bc4b3d078f46
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version
2. Rebuild kernel if compiling from source
3. Reboot system to load new kernel
🔧 Temporary Workarounds
Disable rtw89 driver
linuxPrevent loading of vulnerable driver module
echo 'blacklist rtw89_core' >> /etc/modprobe.d/blacklist-rtw89.conf
rmmod rtw89_core rtw89_pci
🧯 If You Can't Patch
- Disable WiFi or use alternative network interface
- Implement network segmentation to isolate WiFi traffic
🔍 How to Verify
Check if Vulnerable:
Check if rtw89 driver is loaded: lsmod | grep rtw89Check Version:
uname -rVerify Fix Applied:
Check kernel version includes fix commits: uname -r📡 Detection & Monitoring
Log Indicators:
- Kernel oops messages
- System crashes related to WiFi
Network Indicators:
- Unusual WiFi packet patterns triggering C2H events
SIEM Query:
kernel: *Oops* OR kernel: *rtw89*