CVE-2024-57995
📋 TL;DR
This CVE describes a use-after-free vulnerability in the Linux kernel's ath12k WiFi driver. When a virtual interface (vif) is assigned to a different radio device, the driver incorrectly accesses freed memory, potentially leading to kernel crashes or arbitrary code execution. This affects Linux systems using Qualcomm Atheros ath12k WiFi hardware.
💻 Affected Systems
- Linux kernel with ath12k driver
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to system crash or potential privilege escalation to kernel mode, allowing attackers to execute arbitrary code with highest privileges.
Likely Case
System instability, kernel crashes, or denial of service affecting WiFi functionality on affected systems.
If Mitigated
Limited impact if exploit attempts fail or system has kernel hardening features like KASLR and SMEP/SMAP enabled.
🎯 Exploit Status
Exploitation requires local access or ability to interact with WiFi subsystem. No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel versions containing commits 57100b87c77818cb0d582a92e5cb32fff85c757d, 5a10971c7645a95f5d5dc23c26fbac4bf61801d0, or f3a95a312419e4f1e992525917da9dbcd247038f
Vendor Advisory: https://git.kernel.org/stable/c/57100b87c77818cb0d582a92e5cb32fff85c757d
Restart Required: No
Instructions:
1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager to update kernel package. 3. For custom kernels: Apply the patch from kernel git repository. 4. Rebuild and install kernel if compiling from source.
🔧 Temporary Workarounds
Disable ath12k driver
allPrevent loading of vulnerable ath12k driver module
echo 'blacklist ath12k' >> /etc/modprobe.d/blacklist-ath12k.conf
rmmod ath12k
Restrict WiFi interface operations
allLimit non-root user access to WiFi configuration
chmod 600 /sys/class/net/wlan*
setcap -r /usr/sbin/iw
🧯 If You Can't Patch
- Disable ath12k WiFi hardware if not required
- Implement strict access controls to prevent local users from manipulating WiFi interfaces
🔍 How to Verify
Check if Vulnerable:
Check if ath12k module is loaded: lsmod | grep ath12k. Check kernel version against patched versions.Check Version:
uname -rVerify Fix Applied:
Verify kernel version includes fix commits: grep -r '57100b87c77818cb0d582a92e5cb32fff85c757d\|5a10971c7645a95f5d5dc23c26fbac4bf61801d0\|f3a95a312419e4f1e992525917da9dbcd247038f' /usr/src/linux/.📡 Detection & Monitoring
Log Indicators:
- Kernel oops messages in /var/log/kern.log or dmesg
- System crashes or panics related to ath12k driver
- Unexpected WiFi interface state changes
Network Indicators:
- Sudden loss of WiFi connectivity
- Unusual WiFi interface configuration changes
SIEM Query:
source="kernel" AND ("ath12k" OR "use-after-free" OR "kernel panic")