CVE-2024-40930

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-40930", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.583Z", "datePublished": "2024-07-12T12:25:09.110Z", "dateUpdated": "2026-08-05T11:34:06.321Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:34:06.321Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: validate HE operation element parsing\n\nValidate that the HE operation element has the correct\nlength before parsing it."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerability is triggered by parsing the HE Operation element of a raw 802.11 beacon or probe response received over the air, requiring the attacker only to be within radio range on a 6 GHz channel. This is classic WiFi frame injection, which maps to Adjacent.\nAC:L - The attacker deterministically crafts a 7-byte HE Operation element with the 6GHZ_OP_INFO, VHT_OPER_INFO and CO_HOSTED_BSS bits set in he_oper_params, which unconditionally drives the read past the element end; there is no race and no unknown state to win. The victim merely needs a 6 GHz-capable radio performing a scan, which is automatic, routine behavior.\nPR:N - Beacons and 6 GHz broadcast probe responses are parsed during scanning with no authentication, association, or key exchange whatsoever \u2014 ieee80211_scan_rx() accepts them from any BSSID. The attacker needs no credentials or account on the target.\nUI:N - Background and connection-triggered scans run automatically on WiFi clients and APs, so the malicious frame is ingested with no victim action. The user never has to select or connect to the rogue AP.\nS:U - The out-of-bounds read stays within kernel memory managed by the same security authority as the vulnerable cfg80211 code. No VM, IOMMU, or sandbox boundary is crossed.\nC:L - A single byte is read up to five bytes past the end of the received frame buffer, and its REG_INFO bits steer the BSS use_for/cannot_use_reasons flags that cfg80211 exports to userspace via nl80211 \u2014 giving a repeatable few-bit oracle on adjacent kernel memory. The disclosure is real but strictly bounded to one byte at a fixed small offset, so Low rather than High.\nI:N - The bug is a pure read with no out-of-bounds write, no freed-object reuse, and no type confusion, so no attacker-controlled memory modification is possible. The only state it influences is a usability flag on a BSS whose contents the attacker already fully controls.\nA:H - This is a memory-safety violation reading beyond the frame buffer, which produces a KASAN report (a panic under panic_on_warn or kasan.fault=panic, and a trap under Android arm64 MTE) and can fault outright if the buffer ends at a page boundary. An unauthenticated attacker can replay the malformed beacon continuously, so any resulting oops is trivially repeatable."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/wireless/scan.c"], "versions": [{"version": "645f3d85129d8aac3b896ba685fbc20a31c2c036", "lessThan": "f15e3e13e14cc5ae8f950c16efe706add18ac8e2", "status": "affected", "versionType": "git"}, {"version": "645f3d85129d8aac3b896ba685fbc20a31c2c036", "lessThan": "4dc3a3893dae5a7f73e5809273aca0f1f3548d55", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/wireless/scan.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.6", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.9.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f15e3e13e14cc5ae8f950c16efe706add18ac8e2"}, {"url": "https://git.kernel.org/stable/c/4dc3a3893dae5a7f73e5809273aca0f1f3548d55"}], "title": "wifi: cfg80211: validate HE operation element parsing", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:55.787Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/f15e3e13e14cc5ae8f950c16efe706add18ac8e2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4dc3a3893dae5a7f73e5809273aca0f1f3548d55", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40930", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:05:02.066310Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:02.818Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/f15e3e13e14cc5ae8f950c16efe706add18ac8e2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4dc3a3893dae5a7f73e5809273aca0f1f3548d55", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:55.787Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40930", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:05:02.066310Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:14.221Z"}}], "cna": {"title": "wifi: cfg80211: validate HE operation element parsing", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerability is triggered by parsing the HE Operation element of a raw 802.11 beacon or probe response received over the air, requiring the attacker only to be within radio range on a 6 GHz channel. This is classic WiFi frame injection, which maps to Adjacent.\nAC:L - The attacker deterministically crafts a 7-byte HE Operation element with the 6GHZ_OP_INFO, VHT_OPER_INFO and CO_HOSTED_BSS bits set in he_oper_params, which unconditionally drives the read past the element end; there is no race and no unknown state to win. The victim merely needs a 6 GHz-capable radio performing a scan, which is automatic, routine behavior.\nPR:N - Beacons and 6 GHz broadcast probe responses are parsed during scanning with no authentication, association, or key exchange whatsoever \u2014 ieee80211_scan_rx() accepts them from any BSSID. The attacker needs no credentials or account on the target.\nUI:N - Background and connection-triggered scans run automatically on WiFi clients and APs, so the malicious frame is ingested with no victim action. The user never has to select or connect to the rogue AP.\nS:U - The out-of-bounds read stays within kernel memory managed by the same security authority as the vulnerable cfg80211 code. No VM, IOMMU, or sandbox boundary is crossed.\nC:L - A single byte is read up to five bytes past the end of the received frame buffer, and its REG_INFO bits steer the BSS use_for/cannot_use_reasons flags that cfg80211 exports to userspace via nl80211 \u2014 giving a repeatable few-bit oracle on adjacent kernel memory. The disclosure is real but strictly bounded to one byte at a fixed small offset, so Low rather than High.\nI:N - The bug is a pure read with no out-of-bounds write, no freed-object reuse, and no type confusion, so no attacker-controlled memory modification is possible. The only state it influences is a usability flag on a BSS whose contents the attacker already fully controls.\nA:H - This is a memory-safety violation reading beyond the frame buffer, which produces a KASAN report (a panic under panic_on_warn or kasan.fault=panic, and a trap under Android arm64 MTE) and can fault outright if the buffer ends at a page boundary. An unauthenticated attacker can replay the malformed beacon continuously, so any resulting oops is trivially repeatable."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "645f3d85129d8aac3b896ba685fbc20a31c2c036", "lessThan": "f15e3e13e14cc5ae8f950c16efe706add18ac8e2", "versionType": "git"}, {"status": "affected", "version": "645f3d85129d8aac3b896ba685fbc20a31c2c036", "lessThan": "4dc3a3893dae5a7f73e5809273aca0f1f3548d55", "versionType": "git"}], "programFiles": ["net/wireless/scan.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"status": "unaffected", "version": "0", "lessThan": "6.8", "versionType": "semver"}, {"status": "unaffected", "version": "6.9.6", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/wireless/scan.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/f15e3e13e14cc5ae8f950c16efe706add18ac8e2"}, {"url": "https://git.kernel.org/stable/c/4dc3a3893dae5a7f73e5809273aca0f1f3548d55"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: validate HE operation element parsing\n\nValidate that the HE operation element has the correct\nlength before parsing it."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.6", "versionStartIncluding": "6.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "6.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:34:06.321Z"}}}, "cveMetadata": {"cveId": "CVE-2024-40930", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:34:06.321Z", "dateReserved": "2024-07-12T12:17:45.583Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-12T12:25:09.110Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/wireless/scan.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f15e3e13e14cc5ae8f950c16efe706add18ac8e2", "status": "affected", "version": "645f3d85129d8aac3b896ba685fbc20a31c2c036", "versionType": "git"}, {"lessThan": "4dc3a3893dae5a7f73e5809273aca0f1f3548d55", "status": "affected", "version": "645f3d85129d8aac3b896ba685fbc20a31c2c036", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/wireless/scan.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5A16B675-D12F-49F9-AB96-23E6074FF336", "versionEndExcluding": "6.9.6", "versionStartIncluding": "6.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*", "matchCriteriaId": "2EBB4392-5FA6-4DA9-9772-8F9C750109FA", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*", "matchCriteriaId": "331C2F14-12C7-45D5-893D-8C52EE38EA10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: validate HE operation element parsing\n\nValidate that the HE operation element has the correct\nlength before parsing it."}, {"lang": "es", "value": "En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: wifi: cfg80211: validar an\u00e1lisis del elemento de operaci\u00f3n HE Validar que el elemento de operaci\u00f3n HE tenga la longitud correcta antes de analizarlo."}], "id": "CVE-2024-40930", "lastModified": "2026-08-04T11:19:06.890", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-40930", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T17:05:02.066310Z", "version": "2.0.3"}}]}, "published": "2024-07-12T13:15:15.690", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4dc3a3893dae5a7f73e5809273aca0f1f3548d55"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f15e3e13e14cc5ae8f950c16efe706add18ac8e2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4dc3a3893dae5a7f73e5809273aca0f1f3548d55"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f15e3e13e14cc5ae8f950c16efe706add18ac8e2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:9315", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}], "bugzilla": {"description": "kernel: wifi: cfg80211: validate HE operation element parsing", "id": "2297514", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2297514"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.7", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-20", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: cfg80211: validate HE operation element parsing\nValidate that the HE operation element has the correct\nlength before parsing it."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-40930", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-40930\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-40930\nhttps://lore.kernel.org/linux-cve-announce/2024071215-CVE-2024-40930-f6bb@gregkh/T"], "threat_severity": "Moderate"}

{}