CVE-2024-47718

What it actually does

Use-after-free condition occurs when ieee80211_free_hw() is called while rtw_load_firmware_cb() callbacks remain active, allowing KASAN-detected invalid memory access in the rtw88 wifi driver.

Why it matters to the business

Local attackers with low privileges can trigger kernel instability or memory corruption on affected Linux systems, potentially leading to crashes, data exposure, or elevated access; widespread Linux deployments increase operational risk despite low exploit probability.

How an attack unfolds

An attacker with local access triggers USB interface initialization failure paths in rtw_usb_probe(), causing rtw_usb_disconnect() to free hardware structures before firmware callbacks complete, resulting in use-after-free during wowlan or regular firmware loading.

How to fix it

Update the Linux kernel to a version containing the fix for the firmware completion wait logic; apply vendor-supplied backports for supported distributions; disable the affected rtw88 USB driver if updates cannot be applied immediately.

How to confirm the fix worked

Confirm kernel version includes the rtw_wait_firmware_completion change that waits for both firmware attempts; run KASAN-enabled builds and exercise rtw_usb_probe failure paths to verify absence of UAF reports.

Typical attack path

1. Obtain local user access on a vulnerable Linux system with rtw88 USB wifi hardware
2. Trigger rtw_usb_intf_init failure to invoke disconnect path
3. Allow one firmware callback to remain pending while ieee80211_free_hw executes
4. Trigger the dangling reference to achieve memory corruption or crash

How to detect it

Review kernel logs for KASAN use-after-free reports referencing rtw_load_firmware_cb or ieee80211_free_hw; inspect dmesg and syslog for rtw88 probe or disconnect sequences coinciding with crashes.

What your security team should do

• Prioritize kernel updates on systems using rtw88 USB wifi modules
• Monitor vendor advisories for distribution-specific backports
• Restrict local access where possible until patched
• Test updated kernels in staging environments before broad deployment