{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-47714","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-09-30T16:00:12.948Z","datePublished":"2024-10-21T11:53:46.090Z","dateUpdated":"2026-08-05T11:39:40.668Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:39:40.668Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: use hweight16 to get correct tx antenna\n\nThe chainmask is u16 so using hweight8 cannot get correct tx_ant.\nWithout this patch, the tx_ant of band 2 would be -1 and lead to the\nfollowing issue:\nBUG: KASAN: stack-out-of-bounds in mt7996_mcu_add_sta+0x12e0/0x16e0 [mt7996e]"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","baseScore":7.6,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable path is entered from mac80211 station insertion driven by an over-the-air association from a nearby 802.11 peer, with the trigger conditions (EHT/HE/VHT beamforming capability bits, bandwidth, MCS/NSS fields) taken straight from the attacker's association request. This requires radio proximity to the AP's 6 GHz band rather than routable network access, which is Adjacent per the WiFi frame-injection guidance.\nAC:L - On the affected hardware the miscount is deterministic — band 2's chainmask sits entirely above bit 7, so hweight8() always returns 0 and tx_ant is always -1 — and the attacker simply associates while advertising SU-beamformee support to reach matrix[-1][ncol] every time. There is no race, no memory-layout requirement, and the attempt can be repeated indefinitely by re-associating.\nPR:N - In AP mode hostapd creates the station object at association, before the 4-way handshake or any credential validation, so mt7996_mac_sta_add() → mt7996_mcu_sta_bfer_tlv() runs for an attacker holding no key and no account on the target. Open and mesh/IBSS deployments have no authentication gate at all.\nUI:N - The attacker performs the association itself and the AP's kernel processes it automatically; no action by any user or administrator on the victim system is needed.\nS:U - The out-of-bounds read and the resulting bogus firmware-command fields stay within the kernel driver's own security authority, crossing no VM, IOMMU, or sandbox boundary.\nC:L - matrix[-1][ncol] reads adjacent kernel stack memory outside the const array, exposing stack contents that are then written into the sta_rec_bf TLV and transmitted to the WiFi firmware. The read is strictly bounded to the four bytes immediately preceding a 16-byte object at a fixed negative offset with no attacker-directed address and no channel returning the data over the air, so it is a small bounded leak rather than arbitrary read.\nI:L - The uninitialized out-of-bounds byte and the underflowed antenna count (ibf_nrow = 0xFF, mem_20m/mem_total derived from stray stack data) are programmed into the chip's beamforming profile via the MCU STA_REC_UPDATE command, a remotely-influenced corruption of device configuration state. No kernel memory is written out of bounds and no control-flow influence is available, so the modification is limited rather than arbitrary.\nA:H - The condition is a KASAN-detected stack-out-of-bounds in mt7996_mcu_add_sta(), which oopses and panics outright on kernels built with KASAN plus panic_on_warn or kasan.fault=panic — common in vendor and hardened builds. Independently, feeding out-of-range beamforming memory parameters and a 0xFF antenna count to the WiFi MCU can wedge the firmware and take the radio down, and the attacker can retrigger it on every association."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/mediatek/mt76/mt7996/mcu.c"],"versions":[{"version":"98686cd21624c75a043e96812beadddf4f6f48e5","lessThan":"50d87e3b70980abc090676b6b4703fcbd96221f9","status":"affected","versionType":"git"},{"version":"98686cd21624c75a043e96812beadddf4f6f48e5","lessThan":"8f51fc8a9e2fd96363d8ec3f4ee4b78dd64754e3","status":"affected","versionType":"git"},{"version":"98686cd21624c75a043e96812beadddf4f6f48e5","lessThan":"33954930870c18ec549e4bca0eeff43e252cb740","status":"affected","versionType":"git"},{"version":"98686cd21624c75a043e96812beadddf4f6f48e5","lessThan":"f98c3de92bb05dac4a4969df8a4595ed380b4604","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/mediatek/mt76/mt7996/mcu.c"],"versions":[{"version":"6.2","status":"affected"},{"version":"0","lessThan":"6.2","status":"unaffected","versionType":"semver"},{"version":"6.6.54","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.10.13","lessThanOrEqual":"6.10.*","status":"unaffected","versionType":"semver"},{"version":"6.11.2","lessThanOrEqual":"6.11.*","status":"unaffected","versionType":"semver"},{"version":"6.12","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.54"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.10.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.11.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.12"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/50d87e3b70980abc090676b6b4703fcbd96221f9"},{"url":"https://git.kernel.org/stable/c/8f51fc8a9e2fd96363d8ec3f4ee4b78dd64754e3"},{"url":"https://git.kernel.org/stable/c/33954930870c18ec549e4bca0eeff43e252cb740"},{"url":"https://git.kernel.org/stable/c/f98c3de92bb05dac4a4969df8a4595ed380b4604"}],"title":"wifi: mt76: mt7996: use hweight16 to get correct tx antenna","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-47714","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-10-21T13:02:52.416293Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-10-21T13:04:18.545Z"}}]}}