Cloudanix VulnDB

CVE-2024-40942

Medium · 5.5

CVSS

5.5

EPSS

0.3%

Published

Jul 12, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux WiFi mesh handling can cause memory to leak over time when network paths are removed, potentially making systems unstable.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Unreferenced mesh_preq_queue objects remain allocated in ieee80211_if_mesh when mesh paths are deleted without flushing the pending request queue in mesh_path_flush_pending(), resulting in a memory leak.

Why it matters to the business

Systems using Linux kernel WiFi mesh features may experience gradual memory exhaustion, leading to performance degradation or instability in long-running environments with high mesh activity.

How an attack unfolds

An attacker with local access triggers mesh path resolution that queues preq objects via mesh_queue_preq and mesh_nexthop_resolve, then deletes the associated mesh path or interface, leaving the objects unreferenced and accumulating leaks over repeated cycles.

How to fix it

Update the Linux kernel to include commit 377dbb220edc8421b7960691876c5b3bef62f89b which flushes the preq_queue in mesh_path_flush_pending().

How to confirm the fix worked

Confirm the kernel source contains the fix commit; monitor kernel logs for absence of KASAN unreferenced mesh_preq_queue reports after mesh interface removal.

Typical attack path

  1. Obtain local access to a Linux system with mesh networking enabled
  2. Create mesh paths that require path resolution to populate the preq_queue
  3. Delete mesh interfaces or paths to prevent cleanup of queued objects
  4. Repeat operations to accumulate leaked memory allocations

How to detect it

Inspect kernel logs for KASAN reports referencing unreferenced mesh_preq_queue objects allocated from mesh_queue_preq during mesh path operations.

What your security team should do

  • Apply the kernel update containing commit 377dbb220edc8421b7960691876c5b3bef62f89b as soon as possible on affected systems
  • Disable WiFi mesh functionality if not required
  • Monitor memory usage and kernel logs on systems with mesh interfaces enabled

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects The hwmp code use objects of type mesh_preq_queue, added to a list in ieee80211_if_mesh, to keep track of mpath we need to resolve. If the mpath gets deleted, ex mesh interface is removed, the entries in that list will never get cleaned. Fix this by flushing all corresponding items of the preq_queue in mesh_path_flush_pending(). This should take care of KASAN reports like this: unreferenced object 0xffff00000668d800 (size 128): comm "kworker/u8:4", pid 67, jiffies 4295419552 (age 1836.444s) hex dump (first 32 bytes): 00 1f 05 09 00 00 ff ff 00 d5 68 06 00 00 ff ff ..........h..... 8e 97 ea eb 3e b8 01 00 00 00 00 00 00 00 00 00 ....>........... backtrace: [<000000007302a0b6>] __kmem_cache_alloc_node+0x1e0/0x35c [<00000000049bd418>] kmalloc_trace+0x34/0x80 [<0000000000d792bb>] mesh_queue_preq+0x44/0x2a8 [<00000000c99c3696>] mesh_nexthop_resolve+0x198/0x19c [<00000000926bf598>] ieee80211_xmit+0x1d0/0x1f4 [<00000000fc8c2284>] __ieee80211_subif_start_xmit+0x30c/0x764 [<000000005926ee38>] ieee80211_subif_start_xmit+0x9c/0x7a4 [<000000004c86e916>] dev_hard_start_xmit+0x174/0x440 [<0000000023495647>] __dev_queue_xmit+0xe24/0x111c [<00000000cfe9ca78>] batadv_send_skb_packet+0x180/0x1e4 [<000000007bacc5d5>] batadv_v_elp_periodic_work+0x2f4/0x508 [<00000000adc3cd94>] process_one_work+0x4b8/0xa1c [<00000000b36425d1>] worker_thread+0x9c/0x634 [<0000000005852dd5>] kthread+0x1bc/0x1c4 [<000000005fccd770>] ret_from_fork+0x10/0x20 unreferenced object 0xffff000009051f00 (size 128): comm "kworker/u8:4", pid 67, jiffies 4295419553 (age 1836.440s) hex dump (first 32 bytes): 90 d6 92 0d 00 00 ff ff 00 d8 68 06 00 00 ff ff ..........h..... 36 27 92 e4 02 e0 01 00 00 58 79 06 00 00 ff ff 6'.......Xy..... backtrace: [<000000007302a0b6>] __kmem_cache_alloc_node+0x1e0/0x35c [<00000000049bd418>] kmalloc_trace+0x34/0x80 [<0000000000d792bb>] mesh_queue_preq+0x44/0x2a8 [<00000000c99c3696>] mesh_nexthop_resolve+0x198/0x19c [<00000000926bf598>] ieee80211_xmit+0x1d0/0x1f4 [<00000000fc8c2284>] __ieee80211_subif_start_xmit+0x30c/0x764 [<000000005926ee38>] ieee80211_subif_start_xmit+0x9c/0x7a4 [<000000004c86e916>] dev_hard_start_xmit+0x174/0x440 [<0000000023495647>] __dev_queue_xmit+0xe24/0x111c [<00000000cfe9ca78>] batadv_send_skb_packet+0x180/0x1e4 [<000000007bacc5d5>] batadv_v_elp_periodic_work+0x2f4/0x508 [<00000000adc3cd94>] process_one_work+0x4b8/0xa1c [<00000000b36425d1>] worker_thread+0x9c/0x634 [<0000000005852dd5>] kthread+0x1bc/0x1c4 [<000000005fccd770>] ret_from_fork+0x10/0x20

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 5.10.221-1
Debian:11 linux-6.1 0 6.1.119-1~deb11u1
Debian:12 linux 0 6.1.99-1
Debian:13 linux 0 6.9.7-1
Debian:14 linux 0 6.9.7-1
Linux Kernel 2.6.26 4.19.317
SUSE:Linux Enterprise High Availability Extension 12 SP5 kernel-default 0 4.12.14-122.225.1
SUSE:Linux Enterprise High Availability Extension 15 SP5 kernel-default 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise High Availability Extension 15 SP6 kernel-default 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Live Patching 12 SP5 kernel-default 0 4.12.14-122.225.1
SUSE:Linux Enterprise Live Patching 12 SP5 kgraft-patch-SLE12-SP5_Update_59 0 1-8.3.1
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-default 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-livepatch-SLE15-SP5-RT_Update_18 0 1-150500.11.3.1
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_17 0 1-150500.11.3.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-default 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-livepatch-SLE15-SP6-RT_Update_2 0 1-150600.1.3.2
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_4 0 1-150600.13.3.3
SUSE:Linux Enterprise Micro 5.5 kernel-default 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Micro 5.5 kernel-default-base 0 5.14.21-150500.55.73.1.150500.6.33.8
SUSE:Linux Enterprise Micro 5.5 kernel-rt 0 5.14.21-150500.13.64.1
SUSE:Linux Enterprise Micro 5.5 kernel-source-rt 0 5.14.21-150500.13.64.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-64kb 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-default 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-default-base 0 5.14.21-150500.55.73.1.150500.6.33.8
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-source 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-zfcpdump 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-64kb 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-default 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-default-base 0 6.4.0-150600.23.22.1.150600.12.8.3
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-source 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-zfcpdump 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-docs 0 5.14.21-150500.55.73.2
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-obs-build 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-source 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-syms 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-docs 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-obs-build 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-source 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-syms 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Legacy 15 SP5 kernel-default 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Module for Legacy 15 SP6 kernel-default 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5 kernel-azure 0 5.14.21-150500.33.63.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5 kernel-source-azure 0 5.14.21-150500.33.63.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5 kernel-syms-azure 0 5.14.21-150500.33.63.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-azure 0 6.4.0-150600.8.11.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-source-azure 0 6.4.0-150600.8.11.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-syms-azure 0 6.4.0-150600.8.11.1
SUSE:Linux Enterprise Real Time 12 SP5 kernel-rt 0 4.12.14-10.197.1
SUSE:Linux Enterprise Real Time 12 SP5 kernel-rt_debug 0 4.12.14-10.197.1
SUSE:Linux Enterprise Real Time 12 SP5 kernel-source-rt 0 4.12.14-10.197.1
SUSE:Linux Enterprise Real Time 12 SP5 kernel-syms-rt 0 4.12.14-10.197.1
SUSE:Linux Enterprise Server 12 SP5 kernel-azure 0 4.12.14-16.194.1
SUSE:Linux Enterprise Server 12 SP5 kernel-default 0 4.12.14-122.225.1
SUSE:Linux Enterprise Server 12 SP5 kernel-source 0 4.12.14-122.225.1
SUSE:Linux Enterprise Server 12 SP5 kernel-source-azure 0 4.12.14-16.194.1
SUSE:Linux Enterprise Server 12 SP5 kernel-syms 0 4.12.14-122.225.1
SUSE:Linux Enterprise Server 12 SP5 kernel-syms-azure 0 4.12.14-16.194.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP5 kernel-azure 0 4.12.14-16.194.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP5 kernel-default 0 4.12.14-122.225.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP5 kernel-source 0 4.12.14-122.225.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP5 kernel-source-azure 0 4.12.14-16.194.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP5 kernel-syms 0 4.12.14-122.225.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP5 kernel-syms-azure 0 4.12.14-16.194.1
SUSE:Linux Enterprise Software Development Kit 12 SP5 kernel-docs 0 4.12.14-122.225.2
SUSE:Linux Enterprise Software Development Kit 12 SP5 kernel-obs-build 0 4.12.14-122.225.1
SUSE:Linux Enterprise Workstation Extension 12 SP5 kernel-default 0 4.12.14-122.225.1
SUSE:Linux Enterprise Workstation Extension 15 SP5 kernel-default 0 5.14.21-150500.55.73.1
SUSE:Linux Enterprise Workstation Extension 15 SP6 kernel-default 0 6.4.0-150600.23.22.1
SUSE:Real Time Module 15 SP5 kernel-rt 0 5.14.21-150500.13.64.1
SUSE:Real Time Module 15 SP5 kernel-rt_debug 0 5.14.21-150500.13.64.1
SUSE:Real Time Module 15 SP5 kernel-source-rt 0 5.14.21-150500.13.64.1
SUSE:Real Time Module 15 SP5 kernel-syms-rt 0 5.14.21-150500.13.64.1
SUSE:Real Time Module 15 SP6 kernel-rt 0 6.4.0-150600.10.8.3
SUSE:Real Time Module 15 SP6 kernel-rt_debug 0 6.4.0-150600.10.8.3
SUSE:Real Time Module 15 SP6 kernel-source-rt 0 6.4.0-150600.10.8.3
SUSE:Real Time Module 15 SP6 kernel-syms-rt 0 6.4.0-150600.10.8.1
Ubuntu:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure 0 No fix
Ubuntu:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:18.04:LTS linux-gcp 0 No fix
Ubuntu:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:18.04:LTS linux-hwe 0 No fix
Ubuntu:18.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-oem 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.0 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.3 0 No fix
Ubuntu:20.04:LTS linux 0 No fix
Ubuntu:20.04:LTS linux 0 5.4.0-195.215
Ubuntu:20.04:LTS linux-aws 0 No fix
Ubuntu:20.04:LTS linux-aws 0 5.4.0-1132.142
Ubuntu:20.04:LTS linux-aws-5.11 0 No fix
Ubuntu:20.04:LTS linux-aws-5.13 0 No fix
Ubuntu:20.04:LTS linux-aws-5.15 0 No fix
Ubuntu:20.04:LTS linux-aws-5.15 0 5.15.0-1069.75~20.04.1
Ubuntu:20.04:LTS linux-aws-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure 0 No fix
Ubuntu:20.04:LTS linux-azure 0 5.4.0-1137.144
Ubuntu:20.04:LTS linux-azure-5.11 0 No fix
Ubuntu:20.04:LTS linux-azure-5.13 0 No fix
Ubuntu:20.04:LTS linux-azure-5.15 0 No fix
Ubuntu:20.04:LTS linux-azure-5.15 0 5.15.0-1072.81~20.04.1
Ubuntu:20.04:LTS linux-azure-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:20.04:LTS linux-azure-fde-5.15 0 No fix
Ubuntu:20.04:LTS linux-azure-fde-5.15 0 5.15.0-1072.81~20.04.1.1
Ubuntu:20.04:LTS linux-bluefield 0 No fix
Ubuntu:20.04:LTS linux-bluefield 0 5.4.0-1092.99
Ubuntu:20.04:LTS linux-gcp 0 No fix
Ubuntu:20.04:LTS linux-gcp 0 5.4.0-1136.145
Ubuntu:20.04:LTS linux-gcp-5.11 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.13 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.15 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.15 0 5.15.0-1068.76~20.04.1
Ubuntu:20.04:LTS linux-gcp-5.8 0 No fix
Ubuntu:20.04:LTS linux-gke 0 No fix
Ubuntu:20.04:LTS linux-gke-5.15 0 No fix
Ubuntu:20.04:LTS linux-gkeop 0 No fix
Ubuntu:20.04:LTS linux-gkeop 0 5.4.0-1099.103
Ubuntu:20.04:LTS linux-gkeop-5.15 0 No fix
Ubuntu:20.04:LTS linux-gkeop-5.15 0 5.15.0-1052.59~20.04.1
Ubuntu:20.04:LTS linux-hwe-5.11 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.13 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.15 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.15 0 5.15.0-121.131~20.04.1
Ubuntu:20.04:LTS linux-hwe-5.8 0 No fix
Ubuntu:20.04:LTS linux-ibm 0 No fix
Ubuntu:20.04:LTS linux-ibm 0 5.4.0-1079.84
Ubuntu:20.04:LTS linux-ibm-5.15 0 No fix
Ubuntu:20.04:LTS linux-ibm-5.15 0 5.15.0-1062.65~20.04.1
Ubuntu:20.04:LTS linux-intel-5.13 0 No fix
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 No fix
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 5.15.0-1064.70~20.04.1
Ubuntu:20.04:LTS linux-iot 0 No fix
Ubuntu:20.04:LTS linux-iot 0 5.4.0-1043.44
Ubuntu:20.04:LTS linux-kvm 0 No fix
Ubuntu:20.04:LTS linux-kvm 0 5.4.0-1120.128
Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15 0 No fix
Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15 0 5.15.0-121.131~20.04.1
Ubuntu:20.04:LTS linux-nvidia-tegra-5.15 0 5.15.0-1030.30~20.04.1
Ubuntu:20.04:LTS linux-oem-5.10 0 No fix
Ubuntu:20.04:LTS linux-oem-5.13 0 No fix
Ubuntu:20.04:LTS linux-oem-5.14 0 No fix
Ubuntu:20.04:LTS linux-oem-5.6 0 No fix
Ubuntu:20.04:LTS linux-oracle 0 No fix
Ubuntu:20.04:LTS linux-oracle 0 5.4.0-1131.140
Ubuntu:20.04:LTS linux-oracle-5.11 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.13 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.15 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.15 0 5.15.0-1067.73~20.04.1
Ubuntu:20.04:LTS linux-oracle-5.8 0 No fix
Ubuntu:20.04:LTS linux-raspi 0 No fix
Ubuntu:20.04:LTS linux-raspi 0 5.4.0-1116.128
Ubuntu:20.04:LTS linux-raspi2 0 No fix
Ubuntu:20.04:LTS linux-riscv 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.11 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.15 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.15 0 5.15.0-1065.69~20.04.1
Ubuntu:20.04:LTS linux-riscv-5.8 0 No fix
Ubuntu:20.04:LTS linux-xilinx-zynqmp 0 No fix
Ubuntu:20.04:LTS linux-xilinx-zynqmp 0 5.4.0-1051.55
Ubuntu:22.04:LTS linux 0 No fix
Ubuntu:22.04:LTS linux 0 5.15.0-121.131
Ubuntu:22.04:LTS linux-allwinner-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws 0 No fix
Ubuntu:22.04:LTS linux-aws 0 5.15.0-1069.75
Ubuntu:22.04:LTS linux-aws-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws-6.2 0 No fix
Ubuntu:22.04:LTS linux-aws-6.5 0 No fix
Ubuntu:22.04:LTS linux-aws-6.8 0 6.8.0-1015.16~22.04.1
Ubuntu:22.04:LTS linux-azure 0 No fix
Ubuntu:22.04:LTS linux-azure 0 5.15.0-1072.81
Ubuntu:22.04:LTS linux-azure-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-6.2 0 No fix
Ubuntu:22.04:LTS linux-azure-6.5 0 No fix
Ubuntu:22.04:LTS linux-azure-6.8 0 No fix
Ubuntu:22.04:LTS linux-azure-6.8 0 6.8.0-1014.16~22.04.1
Ubuntu:22.04:LTS linux-azure-fde 0 No fix
Ubuntu:22.04:LTS linux-azure-fde 0 5.15.0-1072.81.1
Ubuntu:22.04:LTS linux-azure-fde-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp 0 No fix
Ubuntu:22.04:LTS linux-gcp 0 5.15.0-1068.76
Ubuntu:22.04:LTS linux-gcp-5.19 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.5 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.8 0 6.8.0-1014.16~22.04.1
Ubuntu:22.04:LTS linux-gke 0 No fix
Ubuntu:22.04:LTS linux-gke 0 5.15.0-1066.72
Ubuntu:22.04:LTS linux-gkeop 0 No fix
Ubuntu:22.04:LTS linux-gkeop 0 5.15.0-1052.59
Ubuntu:22.04:LTS linux-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.8 0 6.8.0-45.45~22.04.1

Related vulnerabilities