CVE-2024-57997

What it actually does

Incorrect size calculation for chan_survey memory allocation allows use of uninitialized values when no frames are present on the channel.

Why it matters to the business

Potential kernel instability, crashes, or memory corruption on systems using the affected wireless driver, increasing operational risk and requiring urgent patching.

How an attack unfolds

An attacker with local access triggers channel survey operations on a vulnerable wcn36xx driver instance, causing the kernel to reference uninitialized memory that may be leveraged for further corruption or information disclosure.

How to fix it

Update the Linux kernel to a version containing the fix that replaces the allocation with kcalloc to ensure proper zero-initialization of chan_survey memory.

How to confirm the fix worked

Confirm the kernel version includes the kcalloc change for wcn->chan_survey allocation and verify absence of KASAN reports during channel survey operations with no frames.

Typical attack path

1. Gain local access to a system with the vulnerable Linux kernel wifi driver
2. Trigger channel survey functionality under conditions with no received frames
3. Reference uninitialized memory values in allocated chan_survey structure
4. Attempt to escalate privileges or cause denial of service via memory corruption

How to detect it

Review kernel logs for KASAN reports referencing wcn36xx chan_survey allocation sizes, inspect dmesg or syslog for uninitialized value warnings during wifi operations.

• KASAN: use-after-free or uninitialized-value in wcn36xx
• chan_survey allocation size mismatch

What your security team should do

• Prioritize kernel updates on all affected systems due to memory corruption family classification
• Monitor EPSS and threat actor activity for similar kernel privilege escalation patterns
• Audit wireless driver usage in production environments and restrict unnecessary channel survey access