CVE-2024-47712

What it actually does

Use-after-free in wilc_parse_join_bss_param caused by accessing the TSF field of the ies structure after the RCU read-side critical section is released, allowing reuse of a pointer that may reference freed or updated memory.

Why it matters to the business

Linux systems using the wilc1000 WiFi driver may experience unpredictable kernel behavior, crashes, or memory corruption that disrupts wireless networking and requires system restarts or patches.

How an attack unfolds

An attacker triggers wilc_parse_join_bss_param under conditions where the RCU-protected ies structure is freed or modified between unlock and the subsequent TSF access, leading to use of a dangling pointer; the issue was found via static analysis and no public exploits or specific threat actor campaigns are tied to this exact flaw.

How to fix it

Update the Linux kernel to commit a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6 or later; rebuild and deploy the fixed wilc1000 driver module.

How to confirm the fix worked

Confirm the running kernel contains commit a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6; inspect source for local variable ies_tsf storage of the TSF value before RCU unlock; test wilc_parse_join_bss_param paths under load.

Typical attack path

1. Identify a system running an affected Linux kernel with wilc1000 WiFi driver enabled
2. Craft network conditions or BSS parameters that invoke wilc_parse_join_bss_param
3. Race or manipulate RCU-protected memory lifetime to trigger dereference after unlock
4. Cause use-after-free leading to kernel panic, corruption, or potential code execution

How to detect it

Search kernel logs and dmesg for wilc1000 or RCU warnings around BSS join operations; examine crash dumps for use-after-free signatures in wilc_parse_join_bss_param; no public exploit artifacts are known.

What your security team should do

• Prioritize patching all affected Linux systems to the fixed commit within standard maintenance windows
• Monitor kernel logs for RCU-related warnings or wilc1000 crashes as interim indicators
• Review WiFi driver usage in embedded or IoT deployments where wilc1000 is common