CVE-2024-50008

What it actually does

The flaw is a field-spanning memcpy write of up to 243 bytes into the single-element tlv_buffer array inside struct host_cmd_ds_802_11_scan_ext in the mwifiex driver, which the compiler treats as a one-byte field.

Why it matters to the business

Local users on systems using Marvell wireless chips can trigger kernel warnings or crashes, reducing availability of wireless-dependent workloads across 786 downstream dependents.

How an attack unfolds

An attacker with local access issues an extended 802.11 scan command through the mwifiex driver; the oversized TLV data is copied via memcpy into the undersized array field, producing the field-spanning write.

How to fix it

Apply the upstream fix that replaces the one-element array with a flexible-array member; for Rocky Linux 8 packages update to the listed fixed versions including python-attrs 20.3.0-2, Cython 0.29.21-5, pytest 6.0.2-2 and all other listed modules.

How to confirm the fix worked

Rebuild the mwifiex module and confirm the compiler warning at scan.c:2239 is eliminated; verify the struct definition uses a flexible array member for tlv_buffer.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Load or trigger the mwifiex wireless driver
3. Issue an 802.11 extended scan request containing a large TLV buffer
4. Trigger the memcpy in mwifiex_cmd_802_11_scan_ext

How to detect it

Search kernel logs for the exact warning string "memcpy: detected field-spanning write" originating from mwifiex_cmd_802_11_scan_ext; inspect dmesg or journalctl for the PID and stack trace referencing drivers/net/wireless/marvell/mwifiex/scan.c.

• memcpy: detected field-spanning write (size 243) of single field "ext_scan->tlv_buffer"
• mwifiex_cmd_802_11_scan_ext+0x83/0x90 [mwifiex]

What your security team should do

• Prioritize patching kernel or out-of-tree mwifiex driver on all systems with Marvell wireless hardware
• Monitor EPSS and KEV status for any future elevation in exploitability
• Restrict local user access to wireless configuration interfaces until patches are deployed