{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-27056","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-02-19T14:20:24.214Z","datePublished":"2024-05-01T12:54:56.461Z","dateUpdated":"2026-08-05T11:29:16.379Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:29:16.379Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: ensure offloading TID queue exists\n\nThe resume code path assumes that the TX queue for the offloading TID\nhas been configured. At resume time it then tries to sync the write\npointer as it may have been updated by the firmware.\n\nIn the unusual event that no packets have been send on TID 0, the queue\nwill not have been allocated and this causes a crash. Fix this by\nensuring the queue exist at suspend time."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The faulting code is only entered through a local system suspend/resume (D3/WoWLAN) cycle initiated on the machine itself; no received frame or network input reaches `iwl_mvm_query_wakeup_reasons()` on its own. An adjacent WiFi actor can shape the precondition and even drive the WoWLAN wake, but the power-management transition is the local entry point.\nAC:L - The precondition — TID 0's DQA queue never allocated — is deterministically reachable by suspending after a fresh (re)association or on a link with no UP-0 uplink traffic, and can be forced outright via a QoS Map that steers all traffic off UP 0. Once that state holds, every resume hits the bug with no race to win.\nPR:L - An unprivileged local user on a desktop session can request suspend through logind/polkit, and idle autosuspend reaches it with no privileges at all. No CAP_NET_ADMIN or root is needed to trigger the resume path once WoWLAN is configured, which is the normal state on managed laptop fleets and Chromebooks.\nUI:N - No victim action is required beyond the routine suspend/resume that laptops, tablets and embedded devices perform automatically on idle or lid close. The crash occurs unconditionally in the resume handler.\nS:U - The out-of-bounds access and the corrupted memory both live in the kernel's own address space within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - `trans->txqs.txq[0xFFFF]` reads 8 bytes roughly 512 KB past a 512-entry array — an unbounded out-of-bounds read of unrelated kernel heap, not a few-byte bounded overread. The resulting memory corruption is of the class that can be leveraged for kernel memory disclosure.\nI:H - The out-of-bounds value is dereferenced as a `struct iwl_txq *`, so `spin_lock_bh(&txq->lock)` performs an atomic read-modify-write and `txq->write_ptr`/`read_ptr` store through a kernel pointer the code never validated. That is a write to an out-of-bounds address, i.e. kernel memory corruption of the kind exploitable for control-flow hijacking.\nA:H - Dereferencing a garbage pointer read from beyond the array reliably oopses during system resume, and taking a bogus spinlock can wedge the resume path entirely. The commit message describes it plainly as \"this causes a crash.\""}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/d3.c","drivers/net/wireless/intel/iwlwifi/mvm/sta.c","drivers/net/wireless/intel/iwlwifi/mvm/sta.h"],"versions":[{"version":"ba7136f3f9e849e5776429317bf45ac3d4cfa3f7","lessThan":"4903303f25f48b5a1e34e6324c7fae9ccd6b959a","status":"affected","versionType":"git"},{"version":"ba7136f3f9e849e5776429317bf45ac3d4cfa3f7","lessThan":"35afffaddbe8d310dc61659da0b1a337b0d0addc","status":"affected","versionType":"git"},{"version":"ba7136f3f9e849e5776429317bf45ac3d4cfa3f7","lessThan":"ed35a509390ef4011ea2226da5dd6f62b73873b5","status":"affected","versionType":"git"},{"version":"ba7136f3f9e849e5776429317bf45ac3d4cfa3f7","lessThan":"78f65fbf421a61894c14a1b91fe2fb4437b3fe5f","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/d3.c","drivers/net/wireless/intel/iwlwifi/mvm/sta.c","drivers/net/wireless/intel/iwlwifi/mvm/sta.h"],"versions":[{"version":"5.4","status":"affected"},{"version":"0","lessThan":"5.4","status":"unaffected","versionType":"semver"},{"version":"6.1.132","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.85","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.7.11","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.1.132"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.6.85"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.7.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/4903303f25f48b5a1e34e6324c7fae9ccd6b959a"},{"url":"https://git.kernel.org/stable/c/35afffaddbe8d310dc61659da0b1a337b0d0addc"},{"url":"https://git.kernel.org/stable/c/ed35a509390ef4011ea2226da5dd6f62b73873b5"},{"url":"https://git.kernel.org/stable/c/78f65fbf421a61894c14a1b91fe2fb4437b3fe5f"}],"title":"wifi: iwlwifi: mvm: ensure offloading TID queue exists","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-14T18:56:53.043911Z","id":"CVE-2024-27056","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-14T18:56:59.749Z"}},{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/ed35a509390ef4011ea2226da5dd6f62b73873b5","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/78f65fbf421a61894c14a1b91fe2fb4437b3fe5f","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T19:29:41.505Z"}},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-07-14T12:37:43.339Z"},"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.6","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.6","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.6","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.6","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.6","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}]}]}}