CVE-2024-43848

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-43848", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-17T09:11:59.276Z", "datePublished": "2024-08-17T09:22:02.044Z", "dateUpdated": "2026-08-05T11:36:46.994Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:36:46.994Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix TTLM teardown work\n\nThe worker calculates the wrong sdata pointer, so if it ever\nruns, it'll crash. Fix that."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable work is armed by 802.11 TX-status processing for an MLO/TTLM teardown frame, and its preconditions (MLD association plus an active negotiated TID-to-link mapping installed via PROTECTED_EHT action frames) are established entirely over the air by the peer AP. This requires radio-range/same-WiFi-segment access, matching the Adjacent vector used for mac80211 frame-driven bugs.\nAC:L - A rogue or evil-twin MLD AP fully controls the setup \u2014 it negotiates the TTLM that restricts links and ACKs the resulting teardown frame that queues the work \u2014 and once queued the fault is deterministic, since the bad pointer is a fixed -32-byte offset with no dependence on memory layout or timing.\nPR:N - The attacker operates as an 802.11be AP in radio range and needs no account, credentials, or any privilege on the victim system. No local access to the target is involved at any point in the path.\nUI:N - Association to a known/evil-twin SSID happens automatically via the supplicant's auto-join, and the teardown is initiated by the driver's own link-activation logic rather than by any user action. No victim interaction is needed to reach the faulty worker.\nS:U - The type confusion, the corrupting write, and the wild dereference all occur within the kernel's own memory and security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The wrong `container_of` yields a systematic type confusion in which `vif`, `local`, `flags`, `dev` and `link[]` are all read 32 bytes off, and the resulting bogus `local` (sourced from a timer `expires` field in the sub-4 GB, user-mappable range on non-SMAP systems) is dereferenced and used to reach `local->ops`, providing a read primitive over attacker-influenceable memory.\nI:H - The worker performs a 34-byte zeroing write 32 bytes before the intended target, clobbering live `vif.link_conf[12..14]`, `valid_links`, `active_links`, `dormant_links` and `suspended_links` on an active MLD connection, and then reaches an indirect call `local->ops->vif_cfg_changed()` through the confused pointer \u2014 memory corruption leverageable for control-flow hijacking.\nA:H - As the fix commit states outright, \"if it ever runs, it'll crash\": the bogus `local` pointer (NULL or a jiffies-derived address) is dereferenced in `drv_vif_cfg_changed()`, producing a kernel oops in the wiphy work handler, on top of MLD state corruption that causes further NULL dereferences."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/mlme.c"], "versions": [{"version": "a17a58ad2ff24f0d201fa5f9939182f3757d1737", "lessThan": "9750899410c8478ef043c42029f4f6144c096eac", "status": "affected", "versionType": "git"}, {"version": "a17a58ad2ff24f0d201fa5f9939182f3757d1737", "lessThan": "2fe0a605d083b884490ee4de02be071b5b4291b1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/mlme.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.10.3", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.10.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9750899410c8478ef043c42029f4f6144c096eac"}, {"url": "https://git.kernel.org/stable/c/2fe0a605d083b884490ee4de02be071b5b4291b1"}], "title": "wifi: mac80211: fix TTLM teardown work", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-43848", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:07:33.635400Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:21.571Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-43848", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:07:33.635400Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:22.969Z"}}], "cna": {"title": "wifi: mac80211: fix TTLM teardown work", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a17a58ad2ff24f0d201fa5f9939182f3757d1737", "lessThan": "9750899410c8478ef043c42029f4f6144c096eac", "versionType": "git"}, {"status": "affected", "version": "a17a58ad2ff24f0d201fa5f9939182f3757d1737", "lessThan": "2fe0a605d083b884490ee4de02be071b5b4291b1", "versionType": "git"}], "programFiles": ["net/mac80211/mlme.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"status": "unaffected", "version": "0", "lessThan": "6.10", "versionType": "semver"}, {"status": "unaffected", "version": "6.10.3", "versionType": "semver", "lessThanOrEqual": "6.10.*"}, {"status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/mac80211/mlme.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/9750899410c8478ef043c42029f4f6144c096eac"}, {"url": "https://git.kernel.org/stable/c/2fe0a605d083b884490ee4de02be071b5b4291b1"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix TTLM teardown work\n\nThe worker calculates the wrong sdata pointer, so if it ever\nruns, it'll crash. Fix that."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10.3", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11", "versionStartIncluding": "6.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T20:30:59.119Z"}}}, "cveMetadata": {"cveId": "CVE-2024-43848", "state": "PUBLISHED", "dateUpdated": "2026-05-11T20:30:59.119Z", "dateReserved": "2024-08-17T09:11:59.276Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-08-17T09:22:02.044Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/mac80211/mlme.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9750899410c8478ef043c42029f4f6144c096eac", "status": "affected", "version": "a17a58ad2ff24f0d201fa5f9939182f3757d1737", "versionType": "git"}, {"lessThan": "2fe0a605d083b884490ee4de02be071b5b4291b1", "status": "affected", "version": "a17a58ad2ff24f0d201fa5f9939182f3757d1737", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/mac80211/mlme.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "21DC7A88-E88C-4C44-9AFB-CBB30134097C", "versionEndExcluding": "6.10.3", "versionStartIncluding": "6.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix TTLM teardown work\n\nThe worker calculates the wrong sdata pointer, so if it ever\nruns, it'll crash. Fix that."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: wifi: mac80211: arreglar el trabajo de desmontaje de TTLM El trabajador calcula el puntero sdata incorrecto, por lo que si alguna vez se ejecuta, fallar\u00e1. Arregla eso."}], "id": "CVE-2024-43848", "lastModified": "2026-08-04T11:19:54.780", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-43848", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:07:33.635400Z", "version": "2.0.3"}}]}, "published": "2024-08-17T10:15:10.023", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2fe0a605d083b884490ee4de02be071b5b4291b1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9750899410c8478ef043c42029f4f6144c096eac"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: wifi: mac80211: fix TTLM teardown work", "id": "2305506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2305506"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-20", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: mac80211: fix TTLM teardown work\nThe worker calculates the wrong sdata pointer, so if it ever\nruns, it'll crash. Fix that."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-43848", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-08-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-43848\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-43848\nhttps://lore.kernel.org/linux-cve-announce/2024081732-CVE-2024-43848-4e24@gregkh/T"], "threat_severity": "Moderate"}

{}