CVE-2024-40941 — Out-of-bounds Read in Linux
Severity
5.5MEDIUMNVD
OSV7.8OSV5.3
EPSS
0.0%
top 98.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 12
Latest updateAug 14
Description
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: don't read past the mfuart notifcation
In case the firmware sends a notification that claims it has more data
than it has, we will read past that was allocated for the notification.
Remove the print of the buffer, we won't see it by default. If needed,
we can see the content with tracing.
This was reported by KFENCE.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages6 packages
▶CVEListV5linux/linuxbdccdb854f2fb473f2ac4a6108df3cbfcedd5a87 — 15b37c6fab9d5e40ac399fa1c725118588ed649c+8
Patches
🔴Vulnerability Details
23OSV▶
linux, linux-aws, linux-aws-hwe, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle vulnerabilities↗2024-10-15