CVE-2024-47673

What it actually does

The flaw allows a host command to be sent to the WiFi transport layer after the firmware has stopped, resulting in a kernel WARNING in iwl_trans_send_cmd when TCM recalculation or scan configuration occurs.

Why it matters to the business

Linux systems using affected Intel WiFi hardware may experience driver warnings, potential instability, or degraded wireless functionality until the kernel is updated, increasing operational overhead for large deployments.

How an attack unfolds

An attacker with local access triggers WiFi state changes or scan operations at the exact moment firmware is stopped, causing the unpaused TCM worker to issue a command that hits the bad-state check in the transport layer.

How to fix it

Update the Linux kernel to a version containing commit a15df5f37fa3a8b7a8ec7a339d1e897bc524e28f or later stable releases; for github.com/hashicorp/vault apply version 1.5.6 or newer if the package is present in the environment.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit via git describe or kernel version string, then exercise WiFi scan and power-management paths while monitoring dmesg for absence of the iwl_trans_send_cmd WARNING.

Typical attack path

1. Obtain local code execution on a Linux host with iwlwifi hardware
2. Induce firmware stop condition through power management or error paths
3. Trigger TCM recalculation via scan or connection events
4. Observe resulting kernel WARNING and potential follow-on instability

How to detect it

Review kernel logs for the specific WARNING string referencing iwl_trans_send_cmd and iwl_mvm_tcm_work; correlate with WiFi firmware unload events in dmesg or journalctl.

What your security team should do

• Prioritize kernel updates on all systems exposing Intel WiFi hardware
• Monitor EPSS trend and threat actor reports for any increase in in-the-wild exploitation
• Apply the fix within standard patch windows unless KEV status changes