CVE-2024-57899

What it actually does

On 32-bit systems, or_each_set_bit uses sizeof(changed) yielding 4 bytes instead of the expected 8-byte u64, causing incorrect bit iteration and corruption of mbss changed flags in mac80211.

Why it matters to the business

Wireless mesh networking on 32-bit Linux systems may experience instability or misconfiguration, affecting connectivity in affected environments; low EPSS and no KEV status indicate limited immediate widespread risk despite 634 days since publication.

How an attack unfolds

An attacker triggers ieee80211_link_info_change_notify or ieee80211_mesh_work paths on a 32-bit kernel to induce flag corruption during bit operations, potentially leading to unexpected kernel behavior; listed threat actors reference related kernel access issues but no active campaigns noted.

How to fix it

Apply the listed fixed versions for affected packages: imagemagick (Ubuntu:14.04:LTS) to 8:6.7.7.10-6ubuntu3.11 and imagemagick (Ubuntu:16.04:LTS) to 8:6.8.9.9-7ubuntu5.11; ensure architecture-specific size handling in kernel builds.

How to confirm the fix worked

Verify updated package versions match the fixed releases, confirm no 32-bit size mismatch in mac80211 bit operations via code review or kernel build tests, and check for absence of the reported call trace warnings.

Typical attack path

1. Identify 32-bit Linux system running vulnerable mac80211
2. Initiate WiFi mesh or link info change operations
3. Trigger or_each_set_bit with mismatched 32-bit size on u64 changed flags
4. Cause flag corruption leading to notify or work function anomalies

How to detect it

Search kernel logs for the provided call trace involving ieee80211_link_info_change_notify and exc_overflow; inspect for repeated warnings during cfg80211_wiphy_work or mesh operations on 32-bit architectures.

• ieee80211_link_info_change_notify+0xcc/0xd4 [mac80211]
• exc_overflow+0x30/0x30
• or_each_set_bit(bit, &bits, sizeof(changed) * BITS_PER_BYTE)

What your security team should do

• Prioritize patching 32-bit systems with mesh WiFi configurations due to long publication window
• Monitor for related kernel oops or warn traces in logs
• Validate post-update behavior in test environments before broad deployment