CVE-2024-56599

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath10k: avoid NULL pointer error during sdio remove

When running 'rmmod ath10k', ath10k_sdio_remove() will free sdio

workqueue by destroy_workqueue(). But if CONFIG_INIT_ON_FREE_DEFAULT_ON

is set to yes, kernel panic will happen:

Call trace:

destroy_workqueue+0x1c/0x258

ath10k_sdio_remove+0x84/0x94

sdio_bus_remove+0x50/0x16c

device_release_driver_internal+0x188/0x25c

device_driver_detach+0x20/0x2c

This is because during 'rmmod ath10k', ath10k_sdio_remove() will call

ath10k_core_destroy() before destroy_workqueue(). wiphy_dev_release()

will finally be called in ath10k_core_destroy(). This function will free

struct cfg80211_registered_device *rdev and all its members, including

wiphy, dev and the pointer of sdio workqueue. Then the pointer of sdio

workqueue will be set to NULL due to CONFIG_INIT_ON_FREE_DEFAULT_ON.

After device release, destroy_workqueue() will use NULL pointer then the

kernel panic happen

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References