CVE-2024-46672

What it actually does

NULL pointer dereference of bssid and pmkid fields in cfg80211_pmksa structure when brcmfmac receives SSID-based PMKSA deletion commands from wpa_supplicant 2.11+.

Why it matters to the business

Kernel crashes or denial of service on Linux systems using Broadcom WiFi hardware, causing loss of wireless connectivity and potential system reboots until patched.

How an attack unfolds

wpa_supplicant 2.11 issues SSID-based PMKSA flush commands for SAE/OWE offload; the brcmfmac driver attempts to dereference NULL bssid/pmkid pointers instead of handling the SSID field supported by PMKID_V3.

How to fix it

Apply the upstream fix commit 4291f94f8c6b01505132c22ee27b59ed27c3584f or later stable kernel versions containing the SSID handling change for PMKID_V3 operations in brcmfmac.

How to confirm the fix worked

Verify kernel source contains the SSID copy logic for PMKSA deletion or confirm driver version no longer crashes on SSID-based PMKSA del commands from wpa_supplicant 2.11.

Typical attack path

1. Associate with WiFi network using SAE or OWE authentication
2. Trigger PMKSA flush via wpa_supplicant 2.11 or later
3. Driver receives cfg80211_pmksa deletion command containing SSID but NULL bssid/pmkid
4. brcmfmac dereferences NULL pointers leading to kernel oops or panic

How to detect it

Search kernel logs and crash dumps for brcmfmac cfg80211_pmksa NULL dereference patterns or oops triggered during PMKSA deletion; correlate with wpa_supplicant 2.11+ activity on affected hardware.

• brcmfmac.*pmksa
• cfg80211_pmksa
• NULL bssid
• PMKID_V3

What your security team should do

• Prioritize kernel updates on all Broadcom WiFi Linux endpoints within standard patch windows
• Monitor kernel logs for brcmfmac oops related to pmksa
• Test wireless functionality after upgrade to confirm PMKSA handling works