CVE-2024-41071

What it actually does

Out-of-bounds array indexing in ieee80211_prep_hw_scan when req->n_channels is not initialized before accessing req->channels[], triggering UBSAN array-index-out-of-bounds in net/mac80211/scan.c and enabling memory corruption.

Why it matters to the business

Kernel instability or crashes during wireless scans on Debian 12 Linux systems can disrupt network-dependent operations; widespread use of affected kernels combined with reported exploitation in 2024 zero-day campaigns by espionage and financially motivated actors increases urgency for remediation.

How an attack unfolds

Attacker sends a crafted nl80211_trigger_scan request that reaches __ieee80211_start_scan and ieee80211_prep_hw_scan without setting n_channels, causing out-of-bounds access; this pattern has been observed in Linux kernel exploitation campaigns by espionage and financially motivated actors.

How to fix it

Upgrade the linux package on Debian 12 to version 6.1.115-1 or later.

How to confirm the fix worked

Verify installed kernel version is at least 6.1.115-1 and confirm absence of UBSAN array-index-out-of-bounds reports referencing net/mac80211/scan.c:364 during wireless scan operations.

Typical attack path

1. Send malicious nl80211_trigger_scan via genl_family_rcv_msg
2. Invoke __ieee80211_start_scan without prior channel count setup
3. Call ieee80211_prep_hw_scan with uninitialized req->n_channels
4. Perform out-of-bounds indexing into req->channels[] array
5. Trigger UBSAN fault or memory corruption

How to detect it

Search kernel logs and dmesg for UBSAN array-index-out-of-bounds entries citing net/mac80211/scan.c and ieee80211_prep_hw_scan call traces; correlate with genl_rcv_msg activity from nl80211_trigger_scan.

• UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:364:4
• index 0 is out of range for type 'struct ieee80211_channel *[]'
• ieee80211_prep_hw_scan+0x2db/0x4b0
• __ieee80211_start_scan+0x601/0x990
• nl80211_trigger_scan+0x874/0x980

What your security team should do

• Immediately apply linux 6.1.115-1 update on all Debian 12 systems
• Monitor kernel logs for mac80211 scan UBSAN errors
• Restrict untrusted nl80211 access until patches are deployed
• Test wireless functionality post-upgrade to ensure scan stability