CVE-2024-47714

What it actually does

Incorrect use of hweight8 on a u16 chainmask produces negative tx_ant values, causing stack-out-of-bounds access inside mt7996_mcu_add_sta.

Why it matters to the business

Kernel instability or memory corruption on affected wireless hardware can produce crashes and denial of service; the package appears in many downstream dependents, raising operational risk across Linux systems.

How an attack unfolds

An attacker supplies wireless configuration that exercises band 2 station addition; the faulty antenna count calculation triggers the out-of-bounds condition during MCU command construction. 2024 espionage and financially motivated actors as well as groups exploiting Linux kernel out-of-bounds write and access flaws have shown interest in similar issues.

How to fix it

Apply the kernel patch replacing hweight8 with hweight16; for ebookmeta (PyPI) upgrade to version 1.2.8.

How to confirm the fix worked

Inspect the mt7996 driver source for hweight16 usage and confirm station addition on band 2 no longer produces KASAN warnings.

Typical attack path

1. Locate host running mt7996 hardware
2. Apply wireless settings engaging band 2
3. Trigger station addition via mt7996_mcu_add_sta
4. Induce negative tx_ant leading to stack corruption

How to detect it

Search kernel logs and crash dumps for KASAN stack-out-of-bounds entries referencing mt7996_mcu_add_sta; correlate with wireless station addition events on systems using MediaTek mt7996 chips. Monitor for patterns associated with Linux kernel out-of-bounds vulnerabilities exploited by espionage and ransomware groups.

What your security team should do

• Prioritize kernel updates on all mt7996 systems
• Enable KASAN or similar memory debugging in test environments
• Review wireless logs for stack-out-of-bounds reports