CVE-2024-46827

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix firmware crash due to invalid peer nss

Currently, if the access point receives an association

request containing an Extended HE Capabilities Information

Element with an invalid MCS-NSS, it triggers a firmware

crash.

This issue arises when EHT-PHY capabilities shows support

for a bandwidth and MCS-NSS set for that particular

bandwidth is filled by zeros and due to this, driver obtains

peer_nss as 0 and sending this value to firmware causes

crash.

Address this issue by implementing a validation step for

the peer_nss value before passing it to the firmware. If

the value is greater than zero, proceed with forwarding

it to the firmware. However, if the value is invalid,

reject the association request to prevent potential

firmware crashes.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References