CVE-2024-43842

What it actually does

Incorrect array index variable used in rtw89_sta_info_get_iter() causing out-of-bounds access when rate->he_gi differs from status->he_gi and exceeds array bounds.

Why it matters to the business

Potential kernel instability, crashes, or memory corruption on Linux systems using rtw89 WiFi drivers, affecting 572 downstream dependents with no ransomware usage observed.

How an attack unfolds

Attacker triggers rtw89_sta_info_get_iter with mismatched he_gi values between status and rate structures to exceed array bounds; listed threat actors in 2024 espionage and financial campaigns have targeted similar Linux kernel issues though EPSS remains low at 0.00218 with no trend change.

How to fix it

Apply kernel patches resolving the copy-paste error in rtw89_sta_info_get_iter; for listed certifi (PyPI) dependents upgrade to 2023.7.22 where applicable though primary fix targets kernel source.

How to confirm the fix worked

Confirm patch by reviewing source for use of status->he_gi as array index; test iteration paths with varied he_gi inputs and verify no boundary violations via static analysis or runtime checks.

Typical attack path

1. Locate systems running vulnerable Linux kernel with rtw89 driver
2. Craft network or local input to invoke sta info iteration
3. Supply differing he_gi values to trigger index mistake
4. Cause out-of-bounds memory access for denial of service or further corruption

How to detect it

Review kernel logs and crash dumps for rtw89_sta_info_get_iter related faults or out-of-bounds indicators; correlate with listed threat actor TTPs for Linux kernel resource issues though no confirmed exploitation.

What your security team should do

• Prioritize kernel updates on all rtw89-equipped systems given 786 days since publication
• Monitor EPSS and KEV status for changes despite current low scores
• Audit downstream dependents for any chained exposure from the 572 ecosystem packages