CVE-2024-56663

What it actually does

Off-by-one error in NL80211_ATTR_MLO_LINK_ID range validation permits an out-of-range link identifier that triggers wild-memory-access (KASAN) inside ieee80211_tx_control_port when handling NL80211_CMD_TX_CONTROL_PORT messages.

Why it matters to the business

Linux Wi-Fi systems may experience kernel crashes or denial-of-service when processing malformed wireless management frames or netlink requests, disrupting network connectivity and requiring reboots until patched kernels are deployed.

How an attack unfolds

An attacker with local or wireless-adjacent access crafts a netlink message containing NL80211_ATTR_MLO_LINK_ID set to IEEE80211_MLD_MAX_NUM_LINKS, bypassing the inclusive range check and causing ieee80211_tx_control_port to read beyond allocated structures, resulting in a KASAN-detected wild access and potential system panic.

How to fix it

Apply the upstream fix commit 29e640ae641b9f5ffc666049426d2b16c98d9963 or later stable kernels that correct the NL80211_ATTR_MLO_LINK_ID policy maximum to IEEE80211_MLD_MAX_NUM_LINKS-1; rebuild and reboot with the updated kernel.

How to confirm the fix worked

Confirm the patched policy definition in nl80211.c shows max = IEEE80211_MLD_MAX_NUM_LINKS-1 for NL80211_ATTR_MLO_LINK_ID; run syzkaller or equivalent fuzzer targeting nl80211_tx_control_port and verify absence of KASAN reports.

Typical attack path

1. Obtain local or netlink access on a vulnerable Linux kernel with nl80211 and mac80211 Wi-Fi support enabled
2. Construct a malicious NL80211_CMD_TX_CONTROL_PORT genetlink message with NL80211_ATTR_MLO_LINK_ID equal to the maximum allowed value
3. Send the message via netlink unicast to the nl80211 family
4. Trigger ieee80211_tx_control_port path that dereferences the invalid link ID
5. Observe kernel crash or memory corruption

How to detect it

Search kernel logs for BUG: KASAN entries referencing ieee80211_tx_control_port and nl80211_tx_control_port; inspect netlink audit logs for NL80211_CMD_TX_CONTROL_PORT messages carrying MLO_LINK_ID values at or above the expected maximum.

What your security team should do

• Prioritize kernel updates on all Wi-Fi enabled Linux hosts within standard patch windows
• Monitor for kernel oops or KASAN reports containing ieee80211_tx_control_port and nl80211_tx_control_port
• Restrict unprivileged netlink access where feasible until kernels are updated