{"id":"CVE-2024-47712","state":"PUBLISHED","title":"wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param\n\nIn the `wilc_parse_join_bss_param` function, the TSF field of the `ies`\nstructure is accessed after the RCU read-side critical section is\nunlocked. According to RCU usage rules, this is illegal. Reusing this\npointer can lead to unpredictable behavior, including accessing memory\nthat has been updated or causing use-after-free issues.\n\nThis possible bug was identified using a static analysis tool developed\nby myself, specifically designed to detect RCU-related issues.\n\nTo address this, the TSF value is now stored in a local variable\n`ies_tsf` before the RCU lock is released. The `param->tsf_lo` field is\nthen assigned using this local variable, ensuring that the TSF value is\nsafely accessed.","publishedAt":"2024-10-21T11:53:44.763Z","updatedAt":"2026-08-05T11:39:39.413Z","severity":{"score":8.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e556006de4ea93abe2b46cba202a2556c544b8b2","status":"affected","lessThan":"5a24cedc243ace5ed7c1016f52a7bfc8f5b07815","versionType":"git"},{"version":"b4bbf38c350acb6500cbe667b1e2e68f896e4b38","status":"affected","lessThan":"557418e1704605a81c9e26732449f71b1d40ba1e","versionType":"git"},{"version":"d80fc436751cfa6b02a8eda74eb6cce7dadfe5a2","status":"affected","lessThan":"bf090f4fe935294361eabd9dc5a949fdd77d3d1b","versionType":"git"},{"version":"745003b5917b610352f52fe0d11ef658d6471ec2","status":"affected","lessThan":"b040b71d99ee5e17bb7a743dc01cbfcae8908ce1","versionType":"git"},{"version":"4bfd20d5f5c62b5495d6c0016ee6933bd3add7ce","status":"affected","lessThan":"84398204c5df5aaf89453056cf0647cda9664d2b","versionType":"git"},{"version":"205c50306acf58a335eb19fa84e40140f4fe814f","status":"affected","lessThan":"2f944e6255c2fc1c9bd9ee32f6b14ee0b2a51eb5","versionType":"git"},{"version":"205c50306acf58a335eb19fa84e40140f4fe814f","status":"affected","lessThan":"79510414a7626317f13cc9073244ab7a8deb3192","versionType":"git"},{"version":"205c50306acf58a335eb19fa84e40140f4fe814f","status":"affected","lessThan":"6d7c6ae1efb1ff68bc01d79d94fdf0388f86cdd8","versionType":"git"},{"version":"5800ec78775c0cd646f71eb9bf8402fb794807de","status":"affected","versionType":"git"},{"version":"dd50d3ead6e3707bb0a5df7cc832730c93ace3a7","status":"affected","versionType":"git"},{"version":"5.4.273","status":"affected","lessThan":"5.4.285","versionType":"semver"},{"version":"5.10.214","status":"affected","lessThan":"5.10.227","versionType":"semver"},{"version":"5.15.153","status":"affected","lessThan":"5.15.168","versionType":"semver"},{"version":"6.1.83","status":"affected","lessThan":"6.1.113","versionType":"semver"},{"version":"6.6.23","status":"affected","lessThan":"6.6.54","versionType":"semver"},{"version":"6.7.11","status":"affected","lessThan":"6.8","versionType":"semver"},{"version":"6.8.2","status":"affected","lessThan":"6.9","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/microchip/wilc1000/hif.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.9","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.9","versionType":"semver"},{"version":"5.4.285","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.227","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.168","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.113","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.54","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.10.13","status":"unaffected","lessThanOrEqual":"6.10.*","versionType":"semver"},{"version":"6.11.2","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/microchip/wilc1000/hif.c"]}],"references":["https://git.kernel.org/stable/c/5a24cedc243ace5ed7c1016f52a7bfc8f5b07815","https://git.kernel.org/stable/c/557418e1704605a81c9e26732449f71b1d40ba1e","https://git.kernel.org/stable/c/bf090f4fe935294361eabd9dc5a949fdd77d3d1b","https://git.kernel.org/stable/c/b040b71d99ee5e17bb7a743dc01cbfcae8908ce1","https://git.kernel.org/stable/c/84398204c5df5aaf89453056cf0647cda9664d2b","https://git.kernel.org/stable/c/2f944e6255c2fc1c9bd9ee32f6b14ee0b2a51eb5","https://git.kernel.org/stable/c/79510414a7626317f13cc9073244ab7a8deb3192","https://git.kernel.org/stable/c/6d7c6ae1efb1ff68bc01d79d94fdf0388f86cdd8","https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html","https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:56.516Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/47xxx/CVE-2024-47712.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-47712","state":"PUBLISHED","datePublished":"2024-10-21T11:53:44.763Z","dateUpdated":"2026-08-05T11:39:39.413Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-09-30T16:00:12.948Z"},"containers":{"cna":{"title":"wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param\n\nIn the `wilc_parse_join_bss_param` function, the TSF field of the `ies`\nstructure is accessed after the RCU read-side critical section is\nunlocked. According to RCU usage rules, this is illegal. Reusing this\npointer can lead to unpredictable behavior, including accessing memory\nthat has been updated or causing use-after-free issues.\n\nThis possible bug was identified using a static analysis tool developed\nby myself, specifically designed to detect RCU-related issues.\n\nTo address this, the TSF value is now stored in a local variable\n`ies_tsf` before the RCU lock is released. The `param->tsf_lo` field is\nthen assigned using this local variable, ensuring that the TSF value is\nsafely accessed."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e556006de4ea93abe2b46cba202a2556c544b8b2","status":"affected","lessThan":"5a24cedc243ace5ed7c1016f52a7bfc8f5b07815","versionType":"git"},{"version":"b4bbf38c350acb6500cbe667b1e2e68f896e4b38","status":"affected","lessThan":"557418e1704605a81c9e26732449f71b1d40ba1e","versionType":"git"},{"version":"d80fc436751cfa6b02a8eda74eb6cce7dadfe5a2","status":"affected","lessThan":"bf090f4fe935294361eabd9dc5a949fdd77d3d1b","versionType":"git"},{"version":"745003b5917b610352f52fe0d11ef658d6471ec2","status":"affected","lessThan":"b040b71d99ee5e17bb7a743dc01cbfcae8908ce1","versionType":"git"},{"version":"4bfd20d5f5c62b5495d6c0016ee6933bd3add7ce","status":"affected","lessThan":"84398204c5df5aaf89453056cf0647cda9664d2b","versionType":"git"},{"version":"205c50306acf58a335eb19fa84e40140f4fe814f","status":"affected","lessThan":"2f944e6255c2fc1c9bd9ee32f6b14ee0b2a51eb5","versionType":"git"},{"version":"205c50306acf58a335eb19fa84e40140f4fe814f","status":"affected","lessThan":"79510414a7626317f13cc9073244ab7a8deb3192","versionType":"git"},{"version":"205c50306acf58a335eb19fa84e40140f4fe814f","status":"affected","lessThan":"6d7c6ae1efb1ff68bc01d79d94fdf0388f86cdd8","versionType":"git"},{"version":"5800ec78775c0cd646f71eb9bf8402fb794807de","status":"affected","versionType":"git"},{"version":"dd50d3ead6e3707bb0a5df7cc832730c93ace3a7","status":"affected","versionType":"git"},{"version":"5.4.273","status":"affected","lessThan":"5.4.285","versionType":"semver"},{"version":"5.10.214","status":"affected","lessThan":"5.10.227","versionType":"semver"},{"version":"5.15.153","status":"affected","lessThan":"5.15.168","versionType":"semver"},{"version":"6.1.83","status":"affected","lessThan":"6.1.113","versionType":"semver"},{"version":"6.6.23","status":"affected","lessThan":"6.6.54","versionType":"semver"},{"version":"6.7.11","status":"affected","lessThan":"6.8","versionType":"semver"},{"version":"6.8.2","status":"affected","lessThan":"6.9","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/microchip/wilc1000/hif.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.9","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.9","versionType":"semver"},{"version":"5.4.285","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.227","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.168","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.113","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.54","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.10.13","status":"unaffected","lessThanOrEqual":"6.10.*","versionType":"semver"},{"version":"6.11.2","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/microchip/wilc1000/hif.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/5a24cedc243ace5ed7c1016f52a7bfc8f5b07815"},{"url":"https://git.kernel.org/stable/c/557418e1704605a81c9e26732449f71b1d40ba1e"},{"url":"https://git.kernel.org/stable/c/bf090f4fe935294361eabd9dc5a949fdd77d3d1b"},{"url":"https://git.kernel.org/stable/c/b040b71d99ee5e17bb7a743dc01cbfcae8908ce1"},{"url":"https://git.kernel.org/stable/c/84398204c5df5aaf89453056cf0647cda9664d2b"},{"url":"https://git.kernel.org/stable/c/2f944e6255c2fc1c9bd9ee32f6b14ee0b2a51eb5"},{"url":"https://git.kernel.org/stable/c/79510414a7626317f13cc9073244ab7a8deb3192"},{"url":"https://git.kernel.org/stable/c/6d7c6ae1efb1ff68bc01d79d94fdf0388f86cdd8"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","baseScore":8.3,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The freeing side of the race is driven entirely by received 802.11 beacon/probe-response frames that cause `cfg80211_update_known_bss()` to `kfree_rcu()` the old IE blob, and the gating P2P NoA attribute is supplied in those same frames, so the attacker must be within WiFi radio range of the victim.\nAC:L - The attacker controls both the gating condition (presence of the P2P NoA attribute in its beacons) and the free timing (flooding IE-changing beacons/probe responses), and can retry the race indefinitely across repeated association attempts, giving repeatable success on preemptible kernels.\nPR:N - No credentials on the target are needed — the connect that reaches the vulnerable parser is issued automatically by the supplicant during association/roaming, and even the local trigger `NL80211_CMD_CONNECT` requires only namespace-scoped CAP_NET_ADMIN (`GENL_UNS_ADMIN_PERM`), not real root.\nUI:N - Association and roaming attempts are performed automatically by wpa_supplicant against configured/rogue SSIDs; no victim action is required for the connect path to run.\nS:U - The stale read and its consequences are confined to the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free read of a freed slab object whose contents (freelist pointer or reallocated kernel heap data) are truncated into `param->tsf_lo` and programmed into the firmware's NoA/power-save schedule, leaking freed kernel memory into behavior the adjacent attacker can observe.\nI:L - There is no out-of-bounds or arbitrary write — the only store is into the correctly allocated `param` — but attacker-influenced freed-heap garbage corrupts the TSF/NoA join parameters handed to the device firmware, a bounded integrity impact on driver and firmware state.\nA:H - Dereferencing the freed `cfg80211_bss_ies` can fault and oops if the backing slab page has been returned to the page allocator (attacker can induce this by churning the BSS list), and it triggers KASAN/hardened-allocator panics."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:39:39.413Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.273","versionEndExcluding":"5.4.285"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.214","versionEndExcluding":"5.10.227"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.153","versionEndExcluding":"5.15.168"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.83","versionEndExcluding":"6.1.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.23","versionEndExcluding":"6.6.54"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"6.10.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"6.11.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"6.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-47712","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-10-21T13:03:07.439547Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-21T13:04:18.804Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T22:21:16.228Z"}}]}}}