{"dataType":"CVE_RECORD","cveMetadata":{"cveId":"CVE-2024-27410","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-02-25T13:47:42.682Z","datePublished":"2024-05-17T11:50:43.212Z","dateUpdated":"2026-08-05T11:29:41.060Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:29:41.060Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: reject iftype change with mesh ID change\n\nIt's currently possible to change the mesh ID when the\ninterface isn't yet in mesh mode, at the same time as\nchanging it into mesh mode. This leads to an overwrite\nof data in the wdev->u union for the interface type it\ncurrently has, causing cfg80211_change_iface() to do\nwrong things when switching.\n\nWe could probably allow setting an interface to mesh\nwhile setting the mesh ID at the same time by doing a\ndifferent order of operations here, but realistically\nthere's no userspace that's going to do this, so just\ndisallow changes in iftype when setting mesh ID."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is triggered entirely through local interfaces — an nl80211 generic-netlink `NL80211_CMD_SET_INTERFACE` message to plant the corrupted length, then a local `SIOCGIWESSID` ioctl or `NL80211_CMD_GET_INTERFACE` to weaponize it. No radio frames or remote peer data are involved.\nAC:L - Exploitation is fully deterministic: a single netlink message containing `NL80211_ATTR_IFTYPE=MESH_POINT`, a ≥5-byte `NL80211_ATTR_MESH_ID`, and `NL80211_ATTR_4ADDR=1` on a down ADHOC interface reliably sets `wdev->u.ibss.ssid_len` to an attacker-chosen value and returns before the sanitizing memset. There is no race, no memory-layout dependency, and no condition outside the attacker's control.\nPR:L - `NL80211_CMD_SET_INTERFACE` is gated by `GENL_UNS_ADMIN_PERM`, the user-namespace-aware CAP_NET_ADMIN check, which an unprivileged user obtains via `unshare -Urn`; `mac80211_hwsim`'s radio-creation command is namespace-aware in the same way, giving a wiphy inside that namespace. The weaponizing steps (`SIOCGIWESSID`, `NL80211_CMD_GET_INTERFACE`) require no privileges at all.\nUI:N - The attacker performs every step — creating/selecting the interface, setting it to ADHOC while down, sending the malformed SET_INTERFACE, and issuing the read. No victim action is required.\nS:U - The type-confused write and the resulting heap overflow stay within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The corrupted `ibss.ssid_len` (up to 255) causes up to ~223 bytes past the 32-byte SSID buffer to be copied to userspace via `NL80211_ATTR_SSID` and via the `SIOCGIWESSID` `copy_to_user()` from a 32-byte slab object, disclosing adjacent kernel memory including `wdev->links[]` heap pointers — well beyond a \"few bytes\" bounded read.\nI:H - `cfg80211_ibss_wext_giwessid()` performs an unchecked `memcpy` of up to 255 bytes into the 32-byte `kzalloc` buffer allocated by `ioctl_standard_iw_point()`, giving an out-of-bounds slab write of up to 223 bytes with partially attacker-influenced content — a classic heap-corruption primitive.\nA:H - The out-of-bounds write smashes adjacent kmalloc-32 objects, producing KASAN BUG reports, slab corruption and kernel panics; on mesh-capable wiphys the same bug additionally triggers a `WARN_ONCE` in `check_sdata_in_driver()` via a spurious `drv_leave_ibss()` on a down interface, which panics under `panic_on_warn`."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/wireless/nl80211.c"],"versions":[{"version":"7b0a0e3c3a88260b6fcb017e49f198463aa62ed1","lessThan":"930e826962d9f01dcd2220176134427358d112f2","status":"affected","versionType":"git"},{"version":"7b0a0e3c3a88260b6fcb017e49f198463aa62ed1","lessThan":"177d574be4b58f832354ab1ef5a297aa0c9aa2df","status":"affected","versionType":"git"},{"version":"7b0a0e3c3a88260b6fcb017e49f198463aa62ed1","lessThan":"a2add961a5ed25cfd6a74f9ffb9e7ab6d6ded838","status":"affected","versionType":"git"},{"version":"7b0a0e3c3a88260b6fcb017e49f198463aa62ed1","lessThan":"f78c1375339a291cba492a70eaf12ec501d28a8e","status":"affected","versionType":"git"},{"version":"7a53ad13c09150076b7ddde96c2dfc5622c90b45","status":"affected","versionType":"git"},{"version":"5.19.2","lessThan":"5.20","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/wireless/nl80211.c"],"versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","status":"unaffected","versionType":"semver"},{"version":"6.1.81","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.21","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.7.9","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.1.81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.6.21"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.7.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/930e826962d9f01dcd2220176134427358d112f2"},{"url":"https://git.kernel.org/stable/c/177d574be4b58f832354ab1ef5a297aa0c9aa2df"},{"url":"https://git.kernel.org/stable/c/a2add961a5ed25cfd6a74f9ffb9e7ab6d6ded838"},{"url":"https://git.kernel.org/stable/c/f78c1375339a291cba492a70eaf12ec501d28a8e"}],"title":"wifi: nl80211: reject iftype change with mesh ID change","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-17T17:39:36.191312Z","id":"CVE-2024-27410","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-17T17:43:50.161Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T00:34:52.357Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/d38d31bbbb9dc0d4d71a45431eafba03d0bc150d","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/0cfbb26ee5e7b3d6483a73883f9f6157bca22ec9","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/99eb2159680af8786104dac80528acd5acd45980","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/063715c33b4c37587aeca2c83cf08ead0c542995","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/930e826962d9f01dcd2220176134427358d112f2","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/177d574be4b58f832354ab1ef5a297aa0c9aa2df","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/a2add961a5ed25cfd6a74f9ffb9e7ab6d6ded838","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/f78c1375339a291cba492a70eaf12ec501d28a8e","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html","tags":["x_transferred"]}]}]},"dataVersion":"5.2"}