{"id":"CVE-2024-47714","state":"PUBLISHED","title":"wifi: mt76: mt7996: use hweight16 to get correct tx antenna","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: use hweight16 to get correct tx antenna\n\nThe chainmask is u16 so using hweight8 cannot get correct tx_ant.\nWithout this patch, the tx_ant of band 2 would be -1 and lead to the\nfollowing issue:\nBUG: KASAN: stack-out-of-bounds in mt7996_mcu_add_sta+0x12e0/0x16e0 [mt7996e]","publishedAt":"2024-10-21T11:53:46.090Z","updatedAt":"2026-08-05T11:39:40.668Z","severity":{"score":7.6,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"98686cd21624c75a043e96812beadddf4f6f48e5","status":"affected","lessThan":"50d87e3b70980abc090676b6b4703fcbd96221f9","versionType":"git"},{"version":"98686cd21624c75a043e96812beadddf4f6f48e5","status":"affected","lessThan":"8f51fc8a9e2fd96363d8ec3f4ee4b78dd64754e3","versionType":"git"},{"version":"98686cd21624c75a043e96812beadddf4f6f48e5","status":"affected","lessThan":"33954930870c18ec549e4bca0eeff43e252cb740","versionType":"git"},{"version":"98686cd21624c75a043e96812beadddf4f6f48e5","status":"affected","lessThan":"f98c3de92bb05dac4a4969df8a4595ed380b4604","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/mediatek/mt76/mt7996/mcu.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.2","versionType":"semver"},{"version":"6.6.54","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.10.13","status":"unaffected","lessThanOrEqual":"6.10.*","versionType":"semver"},{"version":"6.11.2","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/mediatek/mt76/mt7996/mcu.c"]}],"references":["https://git.kernel.org/stable/c/50d87e3b70980abc090676b6b4703fcbd96221f9","https://git.kernel.org/stable/c/8f51fc8a9e2fd96363d8ec3f4ee4b78dd64754e3","https://git.kernel.org/stable/c/33954930870c18ec549e4bca0eeff43e252cb740","https://git.kernel.org/stable/c/f98c3de92bb05dac4a4969df8a4595ed380b4604"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:56.516Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/47xxx/CVE-2024-47714.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-47714","state":"PUBLISHED","datePublished":"2024-10-21T11:53:46.090Z","dateUpdated":"2026-08-05T11:39:40.668Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-09-30T16:00:12.948Z"},"containers":{"cna":{"title":"wifi: mt76: mt7996: use hweight16 to get correct tx antenna","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: use hweight16 to get correct tx antenna\n\nThe chainmask is u16 so using hweight8 cannot get correct tx_ant.\nWithout this patch, the tx_ant of band 2 would be -1 and lead to the\nfollowing issue:\nBUG: KASAN: stack-out-of-bounds in mt7996_mcu_add_sta+0x12e0/0x16e0 [mt7996e]"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"98686cd21624c75a043e96812beadddf4f6f48e5","status":"affected","lessThan":"50d87e3b70980abc090676b6b4703fcbd96221f9","versionType":"git"},{"version":"98686cd21624c75a043e96812beadddf4f6f48e5","status":"affected","lessThan":"8f51fc8a9e2fd96363d8ec3f4ee4b78dd64754e3","versionType":"git"},{"version":"98686cd21624c75a043e96812beadddf4f6f48e5","status":"affected","lessThan":"33954930870c18ec549e4bca0eeff43e252cb740","versionType":"git"},{"version":"98686cd21624c75a043e96812beadddf4f6f48e5","status":"affected","lessThan":"f98c3de92bb05dac4a4969df8a4595ed380b4604","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/mediatek/mt76/mt7996/mcu.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.2","versionType":"semver"},{"version":"6.6.54","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.10.13","status":"unaffected","lessThanOrEqual":"6.10.*","versionType":"semver"},{"version":"6.11.2","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/mediatek/mt76/mt7996/mcu.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/50d87e3b70980abc090676b6b4703fcbd96221f9"},{"url":"https://git.kernel.org/stable/c/8f51fc8a9e2fd96363d8ec3f4ee4b78dd64754e3"},{"url":"https://git.kernel.org/stable/c/33954930870c18ec549e4bca0eeff43e252cb740"},{"url":"https://git.kernel.org/stable/c/f98c3de92bb05dac4a4969df8a4595ed380b4604"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","baseScore":7.6,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable path is entered from mac80211 station insertion driven by an over-the-air association from a nearby 802.11 peer, with the trigger conditions (EHT/HE/VHT beamforming capability bits, bandwidth, MCS/NSS fields) taken straight from the attacker's association request. This requires radio proximity to the AP's 6 GHz band rather than routable network access, which is Adjacent per the WiFi frame-injection guidance.\nAC:L - On the affected hardware the miscount is deterministic — band 2's chainmask sits entirely above bit 7, so hweight8() always returns 0 and tx_ant is always -1 — and the attacker simply associates while advertising SU-beamformee support to reach matrix[-1][ncol] every time. There is no race, no memory-layout requirement, and the attempt can be repeated indefinitely by re-associating.\nPR:N - In AP mode hostapd creates the station object at association, before the 4-way handshake or any credential validation, so mt7996_mac_sta_add() → mt7996_mcu_sta_bfer_tlv() runs for an attacker holding no key and no account on the target. Open and mesh/IBSS deployments have no authentication gate at all.\nUI:N - The attacker performs the association itself and the AP's kernel processes it automatically; no action by any user or administrator on the victim system is needed.\nS:U - The out-of-bounds read and the resulting bogus firmware-command fields stay within the kernel driver's own security authority, crossing no VM, IOMMU, or sandbox boundary.\nC:L - matrix[-1][ncol] reads adjacent kernel stack memory outside the const array, exposing stack contents that are then written into the sta_rec_bf TLV and transmitted to the WiFi firmware. The read is strictly bounded to the four bytes immediately preceding a 16-byte object at a fixed negative offset with no attacker-directed address and no channel returning the data over the air, so it is a small bounded leak rather than arbitrary read.\nI:L - The uninitialized out-of-bounds byte and the underflowed antenna count (ibf_nrow = 0xFF, mem_20m/mem_total derived from stray stack data) are programmed into the chip's beamforming profile via the MCU STA_REC_UPDATE command, a remotely-influenced corruption of device configuration state. No kernel memory is written out of bounds and no control-flow influence is available, so the modification is limited rather than arbitrary.\nA:H - The condition is a KASAN-detected stack-out-of-bounds in mt7996_mcu_add_sta(), which oopses and panics outright on kernels built with KASAN plus panic_on_warn or kasan.fault=panic — common in vendor and hardened builds. Independently, feeding out-of-range beamforming memory parameters and a 0xFF antenna count to the WiFi MCU can wedge the firmware and take the radio down, and the attacker can retrigger it on every association."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:39:40.668Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.54"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.10.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.11.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.12"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-47714","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-10-21T13:02:52.416293Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-21T13:04:18.545Z"}}]}}}