CVE-2024-35937

What it actually does

Out-of-bounds read in cfg80211 A-MSDU subframe parsing when an incomplete subframe header is present, leading to potential memory corruption.

Why it matters to the business

On Linux systems handling WiFi traffic, the flaw can cause crashes, instability in wireless drivers, or limited information disclosure affecting network reliability and data confidentiality.

How an attack unfolds

An attacker crafts malicious A-MSDU frames with truncated headers and sends them to a vulnerable Linux kernel via WiFi; the cfg80211 code reads beyond allocated bounds before discarding the frame, potentially enabling information leaks or crashes.

How to fix it

Update the Linux kernel to the fixed commit 9eb3bc0973d084423a6df21cf2c74692ff05647e or later stable release containing the A-MSDU header length check.

How to confirm the fix worked

Verify the kernel source includes the updated A-MSDU format checks in cfg80211 and confirm no out-of-bounds access occurs with malformed frames via code review or fuzz testing.

Typical attack path

1. Identify target running vulnerable Linux kernel with WiFi enabled
2. Send crafted A-MSDU frames over the wireless medium
3. Trigger incomplete subframe header condition in cfg80211
4. Cause out-of-bounds memory read during parsing

How to detect it

Review kernel logs for cfg80211 warnings or crashes related to A-MSDU parsing; look for unusual wireless frame handling errors preceding stability issues.

What your security team should do

• Prioritize kernel updates on all Linux systems with wireless networking
• Monitor for wireless driver stability issues in logs
• Apply the patch from the referenced stable commit immediately