{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-47721","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-09-30T16:00:12.950Z","datePublished":"2024-10-21T11:53:50.861Z","dateUpdated":"2026-08-05T11:39:41.958Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:39:41.958Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading\n\nThe handler of firmware C2H event RTW89_MAC_C2H_FUNC_READ_WOW_CAM isn't\nimplemented, but driver expects number of handlers is\nNUM_OF_RTW89_MAC_C2H_FUNC_WOW causing out-of-bounds access. Fix it by\nremoving ID.\n\nAddresses-Coverity-ID: 1598775 (\"Out-of-bounds read\")"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The malicious C2H event originates from the Wi-Fi device firmware, whose state and event emission are driven by over-the-air activity (WoWLAN wake patterns, association/rekey traffic) from an attacker within radio range, and the WOW-class dispatch path is entered directly from the device interrupt handler. Consistent with kernel CNA practice for firmware-supplied-index OOB bugs in wireless drivers, this is Adjacent rather than Network.\nAC:L - The class and func fields are consumed verbatim from the C2H header with no validation whatsoever, so a single event with class=0x3/func=1 deterministically triggers the out-of-bounds fetch and indirect call — no race, no memory-layout grooming, and no timing window is involved.\nPR:N - The C2H dispatch path is gated only by RTW89_FLAG_RUNNING (interface up); there is no capability check, no authentication, and no requirement that WoWLAN was configured by a privileged process. The attacker needs no credentials on the target system.\nUI:N - No victim action is required — the event is processed asynchronously in the driver's interrupt/work path as soon as it arrives, independent of any user activity such as suspending the machine or configuring WoWLAN.\nS:U - The out-of-bounds read and the resulting indirect call both occur within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Reading past the one-element handler table and invoking the resulting pointer produces a type confusion with adjacent same-signature C2H handlers, which cast skb->data to fixed structs and memcpy fixed lengths without honoring len — leaking out-of-bounds heap contents into driver state, including WoWLAN key-material buffers (GTK/PTK/IGTK/IV). Combined with the leak of kernel .rodata contents through the branch target, this is a high confidentiality impact.\nI:H - The OOB slot is dereferenced as a function pointer and called, so an attacker-induced event transfers control to an address the kernel never intended to branch to — a control-flow-integrity violation and potential code-execution primitive — while the type-confused handler also writes unvalidated firmware-controlled data into driver key/state structures.\nA:H - Calling a garbage or mismatched function pointer from interrupt/atomic context reliably produces a kernel oops, CFI panic, or memory corruption crash, and the event can be re-delivered repeatedly."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/realtek/rtw89/mac.h"],"versions":[{"version":"ff53fce5c78ba27ec7eb0baff7ef9648fde7ad8e","lessThan":"10463308b9454f534d03300cf679bc4b3d078f46","status":"affected","versionType":"git"},{"version":"ff53fce5c78ba27ec7eb0baff7ef9648fde7ad8e","lessThan":"2c9c2d1a20916589497a7facbea3e82cabec4ab8","status":"affected","versionType":"git"},{"version":"ff53fce5c78ba27ec7eb0baff7ef9648fde7ad8e","lessThan":"56310ddb50b190b3390fdc974aec455d0a516bd2","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/realtek/rtw89/mac.h"],"versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","status":"unaffected","versionType":"semver"},{"version":"6.10.13","lessThanOrEqual":"6.10.*","status":"unaffected","versionType":"semver"},{"version":"6.11.2","lessThanOrEqual":"6.11.*","status":"unaffected","versionType":"semver"},{"version":"6.12","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.10.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.11.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.12"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/10463308b9454f534d03300cf679bc4b3d078f46"},{"url":"https://git.kernel.org/stable/c/2c9c2d1a20916589497a7facbea3e82cabec4ab8"},{"url":"https://git.kernel.org/stable/c/56310ddb50b190b3390fdc974aec455d0a516bd2"}],"title":"wifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-47721","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-10-21T13:02:00.306477Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-10-21T13:04:17.474Z"}}]}}