CVE-2024-36922

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-36922", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-30T15:25:07.068Z", "datePublished": "2024-05-30T15:29:16.852Z", "dateUpdated": "2026-10-15T00:42:49.285Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:32:06.118Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: read txq->read_ptr under lock\n\nIf we read txq->read_ptr without lock, we can read the same\nvalue twice, then obtain the lock, and reclaim from there\nto two different places, but crucially reclaim the same\nentry twice, resulting in the WARN_ONCE() a little later.\nFix that by reading txq->read_ptr under lock."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable reclaim path is driven entirely by over-the-air activity \u2014 firmware TX/BA completions for transmitted frames and flush operations triggered by connection-state changes \u2014 so an attacker within WiFi radio range (rogue AP or frame injection) can drive it. Per WiFi frame-injection guidance this is Adjacent, not Local.\nAC:L - The attacker controls both sides of the race: sustained traffic keeps TX_CMD/BA_NOTIF reclaims firing in the RX softirq path, while injected deauth/disassoc or channel-switch frames repeatedly trigger the process-context flush reclaim, and the attempt can be retried indefinitely at high rate until the unlocked read is interleaved.\nPR:N - No credentials or authentication are required \u2014 deauth/disassoc injection and rogue-AP association handling are pre-authentication, and the reclaim path is exercised by ordinary unauthenticated 802.11 traffic and management frames.\nUI:N - No victim action is needed; an active WiFi connection carrying traffic is the normal operating state, and the flush/completion interleaving happens without any user involvement.\nS:U - The corrupted TX queue state, leaked buffers and resulting crash are all confined to the kernel's own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The desynchronized read_ptr lets the loop unmap DMA buffers and release skbs for TFDs the firmware still owns, leaving stale valid TFDs in the ring that the device can fetch and transmit, exposing kernel buffer contents over the air; per guidance, memory corruption leverageable for disclosure is High.\nI:H - Premature reclaim tears down DMA mappings and frees buffers still referenced by hardware TFDs, so the device can DMA into unmapped or reallocated memory, and the ring accounting itself is corrupted \u2014 a memory-corruption primitive rather than a bounded state error.\nA:H - The bug directly produces WARN_ONCE/WARN_ON splats (a panic under panic_on_warn), and the corrupted read_ptr makes iwl_txq_space() return 0 permanently, wedging the TX queue and triggering the queue-stuck watchdog/firmware restart with loss of connectivity."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/intel/iwlwifi/queue/tx.c"], "versions": [{"version": "7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6", "lessThan": "f30e8af109818c9db08cbcc46eb9713fe4b530ba", "status": "affected", "versionType": "git"}, {"version": "7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6", "lessThan": "aab7b39fcac5f6165f6434bcbb56bb7865d4ad2b", "status": "affected", "versionType": "git"}, {"version": "7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6", "lessThan": "b83db8e756dec68a950ed2f056248b1704b3deaa", "status": "affected", "versionType": "git"}, {"version": "7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6", "lessThan": "43d07103df670484cdd26f9588eabef80f69db89", "status": "affected", "versionType": "git"}, {"version": "7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6", "lessThan": "c2ace6300600c634553657785dfe5ea0ed688ac2", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/intel/iwlwifi/queue/tx.c"], "versions": [{"version": "4.19", "status": "affected"}, {"version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.31", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.10", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.6.31"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.8.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f30e8af109818c9db08cbcc46eb9713fe4b530ba"}, {"url": "https://git.kernel.org/stable/c/aab7b39fcac5f6165f6434bcbb56bb7865d4ad2b"}, {"url": "https://git.kernel.org/stable/c/b83db8e756dec68a950ed2f056248b1704b3deaa"}, {"url": "https://git.kernel.org/stable/c/43d07103df670484cdd26f9588eabef80f69db89"}, {"url": "https://git.kernel.org/stable/c/c2ace6300600c634553657785dfe5ea0ed688ac2"}], "title": "wifi: iwlwifi: read txq->read_ptr under lock", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:49.981Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/b83db8e756dec68a950ed2f056248b1704b3deaa", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/43d07103df670484cdd26f9588eabef80f69db89", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c2ace6300600c634553657785dfe5ea0ed688ac2", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36922", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:16:00.944037Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:59.986Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:42:49.285Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/b83db8e756dec68a950ed2f056248b1704b3deaa", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/43d07103df670484cdd26f9588eabef80f69db89", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c2ace6300600c634553657785dfe5ea0ed688ac2", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:49.981Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:42:49.285Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36922", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:16:00.944037Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:27.399Z"}}], "cna": {"title": "wifi: iwlwifi: read txq->read_ptr under lock", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable reclaim path is driven entirely by over-the-air activity \u2014 firmware TX/BA completions for transmitted frames and flush operations triggered by connection-state changes \u2014 so an attacker within WiFi radio range (rogue AP or frame injection) can drive it. Per WiFi frame-injection guidance this is Adjacent, not Local.\nAC:L - The attacker controls both sides of the race: sustained traffic keeps TX_CMD/BA_NOTIF reclaims firing in the RX softirq path, while injected deauth/disassoc or channel-switch frames repeatedly trigger the process-context flush reclaim, and the attempt can be retried indefinitely at high rate until the unlocked read is interleaved.\nPR:N - No credentials or authentication are required \u2014 deauth/disassoc injection and rogue-AP association handling are pre-authentication, and the reclaim path is exercised by ordinary unauthenticated 802.11 traffic and management frames.\nUI:N - No victim action is needed; an active WiFi connection carrying traffic is the normal operating state, and the flush/completion interleaving happens without any user involvement.\nS:U - The corrupted TX queue state, leaked buffers and resulting crash are all confined to the kernel's own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The desynchronized read_ptr lets the loop unmap DMA buffers and release skbs for TFDs the firmware still owns, leaving stale valid TFDs in the ring that the device can fetch and transmit, exposing kernel buffer contents over the air; per guidance, memory corruption leverageable for disclosure is High.\nI:H - Premature reclaim tears down DMA mappings and frees buffers still referenced by hardware TFDs, so the device can DMA into unmapped or reallocated memory, and the ring accounting itself is corrupted \u2014 a memory-corruption primitive rather than a bounded state error.\nA:H - The bug directly produces WARN_ONCE/WARN_ON splats (a panic under panic_on_warn), and the corrupted read_ptr makes iwl_txq_space() return 0 permanently, wedging the TX queue and triggering the queue-stuck watchdog/firmware restart with loss of connectivity."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6", "lessThan": "f30e8af109818c9db08cbcc46eb9713fe4b530ba", "versionType": "git"}, {"status": "affected", "version": "7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6", "lessThan": "aab7b39fcac5f6165f6434bcbb56bb7865d4ad2b", "versionType": "git"}, {"status": "affected", "version": "7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6", "lessThan": "b83db8e756dec68a950ed2f056248b1704b3deaa", "versionType": "git"}, {"status": "affected", "version": "7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6", "lessThan": "43d07103df670484cdd26f9588eabef80f69db89", "versionType": "git"}, {"status": "affected", "version": "7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6", "lessThan": "c2ace6300600c634553657785dfe5ea0ed688ac2", "versionType": "git"}], "programFiles": ["drivers/net/wireless/intel/iwlwifi/queue/tx.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"status": "unaffected", "version": "0", "lessThan": "4.19", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.209", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.175", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.31", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.10", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wireless/intel/iwlwifi/queue/tx.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/f30e8af109818c9db08cbcc46eb9713fe4b530ba"}, {"url": "https://git.kernel.org/stable/c/aab7b39fcac5f6165f6434bcbb56bb7865d4ad2b"}, {"url": "https://git.kernel.org/stable/c/b83db8e756dec68a950ed2f056248b1704b3deaa"}, {"url": "https://git.kernel.org/stable/c/43d07103df670484cdd26f9588eabef80f69db89"}, {"url": "https://git.kernel.org/stable/c/c2ace6300600c634553657785dfe5ea0ed688ac2"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: read txq->read_ptr under lock\n\nIf we read txq->read_ptr without lock, we can read the same\nvalue twice, then obtain the lock, and reclaim from there\nto two different places, but crucially reclaim the same\nentry twice, resulting in the WARN_ONCE() a little later.\nFix that by reading txq->read_ptr under lock."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.209", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.175", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.31", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.10", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "4.19"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:32:06.118Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36922", "state": "PUBLISHED", "dateUpdated": "2026-10-15T00:42:49.285Z", "dateReserved": "2024-05-30T15:25:07.068Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-30T15:29:16.852Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/intel/iwlwifi/queue/tx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f30e8af109818c9db08cbcc46eb9713fe4b530ba", "status": "affected", "version": "7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6", "versionType": "git"}, {"lessThan": "aab7b39fcac5f6165f6434bcbb56bb7865d4ad2b", "status": "affected", "version": "7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6", "versionType": "git"}, {"lessThan": "b83db8e756dec68a950ed2f056248b1704b3deaa", "status": "affected", "version": "7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6", "versionType": "git"}, {"lessThan": "43d07103df670484cdd26f9588eabef80f69db89", "status": "affected", "version": "7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6", "versionType": "git"}, {"lessThan": "c2ace6300600c634553657785dfe5ea0ed688ac2", "status": "affected", "version": "7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/intel/iwlwifi/queue/tx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"lessThan": "4.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.31", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E3E590E3-9122-405E-A816-1B69540EC77D", "versionEndExcluding": "6.6.31", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A6B920C-8D8F-4130-86B4-AD334F4CF2E3", "versionEndExcluding": "6.8.10", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*", "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: read txq->read_ptr under lock\n\nIf we read txq->read_ptr without lock, we can read the same\nvalue twice, then obtain the lock, and reclaim from there\nto two different places, but crucially reclaim the same\nentry twice, resulting in the WARN_ONCE() a little later.\nFix that by reading txq->read_ptr under lock."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: iwlwifi: leer txq->read_ptr bajo bloqueo Si leemos txq->read_ptr sin bloqueo, podemos leer el mismo valor dos veces, luego obtener el bloqueo y reclamar desde all\u00ed a dos lugares diferentes, pero fundamentalmente reclama la misma entrada dos veces, lo que resulta en WARN_ONCE() un poco m\u00e1s tarde. Solucione eso leyendo txq->read_ptr bajo bloqueo."}], "id": "CVE-2024-36922", "lastModified": "2026-10-15T01:18:25.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-36922", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T17:16:00.944037Z", "version": "2.0.3"}}]}, "published": "2024-05-30T16:15:15.470", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/43d07103df670484cdd26f9588eabef80f69db89"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aab7b39fcac5f6165f6434bcbb56bb7865d4ad2b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b83db8e756dec68a950ed2f056248b1704b3deaa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c2ace6300600c634553657785dfe5ea0ed688ac2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f30e8af109818c9db08cbcc46eb9713fe4b530ba"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/43d07103df670484cdd26f9588eabef80f69db89"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b83db8e756dec68a950ed2f056248b1704b3deaa"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c2ace6300600c634553657785dfe5ea0ed688ac2"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:7000", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-553.22.1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-09-24T00:00:00Z"}, {"advisory": "RHSA-2024:5363", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.31.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-08-15T00:00:00Z"}, {"advisory": "RHSA-2024:5363", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.31.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-08-15T00:00:00Z"}, {"advisory": "RHSA-2024:5364", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "kernel-0:5.14.0-284.79.1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-08-14T00:00:00Z"}, {"advisory": "RHSA-2024:5365", "cpe": "cpe:/a:redhat:rhel_eus:9.2::nfv", "package": "kernel-rt-0:5.14.0-284.79.1.rt14.364.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-08-14T00:00:00Z"}], "bugzilla": {"description": "kernel: wifi: iwlwifi: read txq->read_ptr under lock", "id": "2284511", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2284511"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-413", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: iwlwifi: read txq->read_ptr under lock\nIf we read txq->read_ptr without lock, we can read the same\nvalue twice, then obtain the lock, and reclaim from there\nto two different places, but crucially reclaim the same\nentry twice, resulting in the WARN_ONCE() a little later.\nFix that by reading txq->read_ptr under lock."], "name": "CVE-2024-36922", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-30T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-36922\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-36922\nhttps://lore.kernel.org/linux-cve-announce/2024053039-CVE-2024-36922-f0df@gregkh/T"], "threat_severity": "Low"}

{}