CVE-2024-35937

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check A-MSDU format more carefully If it looks like there's another subframe in the A-MSDU but the header isn't fully there, we can end up reading data out of bounds, only to discard later. Make this a bit more careful and check if the subframe header can even be present.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/16da1e1dac23be45ef6e23c41b1508c400e6c544	Patch
https://git.kernel.org/stable/c/5d7a8585fbb31e88fb2a0f581b70667d3300d1e9	Patch
https://git.kernel.org/stable/c/9ad7974856926129f190ffbe3beea78460b3b7cc	Patch
https://git.kernel.org/stable/c/9eb3bc0973d084423a6df21cf2c74692ff05647e	Patch
https://git.kernel.org/stable/c/16da1e1dac23be45ef6e23c41b1508c400e6c544	Patch
https://git.kernel.org/stable/c/5d7a8585fbb31e88fb2a0f581b70667d3300d1e9	Patch
https://git.kernel.org/stable/c/9ad7974856926129f190ffbe3beea78460b3b7cc	Patch
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:debian:debian_linux:11.0:::::::*
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

08 Oct 2026, 18:21

Type	Values Removed	Values Added
References	~~() https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html -~~	() https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html - Mailing List, Third Party Advisory
First Time		Debian Debian debian Linux
CPE		cpe:2.3:o:debian:debian_linux:11.0:::::::*

Information

Published : 2024-05-19 11:15

Updated : 2026-10-08 18:21

NVD link : CVE-2024-35937

Mitre link : CVE-2024-35937

CVE.ORG link : CVE-2024-35937

JSON object : View

Products Affected

debian

debian_linux

linux

linux_kernel

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2024-35937", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-35937", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:40:52.262285Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "966d5c2c22edcc0ab3d519af39f91a29329c979a", "lessThan": "9eb3bc0973d084423a6df21cf2c74692ff05647e", "versionType": "git"}, {"status": "affected", "version": "6e4c0d0460bd32ca9244dff3ba2d2da27235de11", "lessThan": "5d7a8585fbb31e88fb2a0f581b70667d3300d1e9", "versionType": "git"}, {"status": "affected", "version": "6e4c0d0460bd32ca9244dff3ba2d2da27235de11", "lessThan": "16da1e1dac23be45ef6e23c41b1508c400e6c544", "versionType": "git"}, {"status": "affected", "version": "6e4c0d0460bd32ca9244dff3ba2d2da27235de11", "lessThan": "9ad7974856926129f190ffbe3beea78460b3b7cc", "versionType": "git"}], "programFiles": ["net/wireless/util.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"status": "unaffected", "version": "0", "lessThan": "6.3", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.27", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.6", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/wireless/util.c"], "defaultStatus": "affected"}]}], "published": "2024-05-19T11:15:49.553", "references": [{"url": "https://git.kernel.org/stable/c/16da1e1dac23be45ef6e23c41b1508c400e6c544", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5d7a8585fbb31e88fb2a0f581b70667d3300d1e9", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9ad7974856926129f190ffbe3beea78460b3b7cc", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9eb3bc0973d084423a6df21cf2c74692ff05647e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/16da1e1dac23be45ef6e23c41b1508c400e6c544", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://git.kernel.org/stable/c/5d7a8585fbb31e88fb2a0f581b70667d3300d1e9", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://git.kernel.org/stable/c/9ad7974856926129f190ffbe3beea78460b3b7cc", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: check A-MSDU format more carefully\n\nIf it looks like there's another subframe in the A-MSDU\nbut the header isn't fully there, we can end up reading\ndata out of bounds, only to discard later. Make this a\nbit more careful and check if the subframe header can\neven be present."}, {"lang": "es", "value": "En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: wifi: cfg80211: comprueba m\u00e1s detenidamente el formato A-MSDU Si parece que hay otra subtrama en el A-MSDU pero el encabezado no est\u00e1 completamente ah\u00ed, podemos terminar leyendo datos fuera de l\u00edmites, s\u00f3lo para descartarlo m\u00e1s tarde. Haga esto un poco m\u00e1s cuidadoso y verifique si el encabezado del subtrama puede estar presente."}], "lastModified": "2026-10-08T18:21:56.640", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2D6F9C68-68FA-4103-9708-1F7E49ED5383", "versionEndExcluding": "6.6.27", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22CA5433-1303-41EF-AD4C-F4645DC01541", "versionEndExcluding": "6.8.6", "versionStartIncluding": "6.7"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}