CVE-2024-41072

What it actually does

The flaw permits an ioctl(SIOCSIWSCAN) request to supply a channel count exceeding IW_MAX_FREQUENCIES to cfg80211_wext_siwscan without validation, allowing invalid data to reach kernel wireless handling code.

Why it matters to the business

Local users on affected Linux systems can trigger crashes or instability in wireless networking stacks, causing denial of service and operational disruption on Wi-Fi enabled devices until the system is restarted.

How an attack unfolds

An attacker with local access prepares an SIOCSIWSCAN ioctl containing more channels than IW_MAX_FREQUENCIES and invokes it against the kernel's cfg80211 wext path, which previously accepted the request without bounds checking.

How to fix it

Update the Linux kernel to a revision containing commit b02ba9a0b55b762bd04743a22f3d9f9645005e79 that adds the IW_MAX_FREQUENCIES bounds check before processing the scan request.

How to confirm the fix worked

Confirm the patched kernel source contains the added channel-count validation in cfg80211_wext_siwscan, rebuild, boot the new kernel, and verify that oversized SIOCSIWSCAN requests now return -EINVAL.

Typical attack path

1. Gain local shell or process execution on the target system
2. Allocate or craft a wireless scan request structure with channel count > IW_MAX_FREQUENCIES
3. Call ioctl on a socket with SIOCSIWSCAN and the oversized data
4. Reach the unvalidated cfg80211_wext_siwscan path and induce kernel failure

How to detect it

Search kernel logs and audit trails for cfg80211 or wext error messages around SIOCSIWSCAN calls; inspect processes issuing wireless ioctls for anomalous channel counts.

What your security team should do

• Apply the referenced kernel commit or a distribution update containing the fix at the earliest opportunity
• Limit unprivileged local access on systems exposing wireless interfaces
• Review wireless-related kernel logs for repeated invalid scan requests after patching