Read the docs
TI-2024-31990 Aliases CVE-2024-47712GHSA-pgpc-54gc-3694

wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param

Priority LOW 36CWE-476Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
High · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param In the `wilc_parse_join_bss_param` function, the TSF field of the `ies` structure is accessed after the RCU read-side critical section is unlocked. According to RCU usage rules, this is illegal. Reusing this pointer can lead to unpredictable behavior, including accessing memory that has been updated or causing use-after-free issues. This possible bug was identified using a static analysis tool developed by myself, specifically designed to detect RCU-related issues. To address this, the TSF value is now stored in a local variable `ies_tsf` before the RCU lock is released. The `param->tsf_lo` field is then assigned using this local variable, ensuring that the TSF value is safely accessed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00365 30th percentileScored 2026-11-07
Fix Fixed Linux (Linux): 5.4.285, 5.10.227, 5.15.168 +7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux5.4.273 to before 5.4.285; 5.10.214 to before 5.10.227; 5.15.153 to before 5.15.168; 6.1.83 to before 6.1.113; 6.6.23 to before 6.6.54; 6.7.11 to before 6.8; 6.8.2 to before 6.95.4.285, 5.10.227, 5.15.168, 6.1.113, 6.6.54, 6.8, 6.9Patch availableCNA
LinuxLinux6.9 and later5.4.285, 5.10.227, 5.15.168, 6.1.113, 6.6.54, 6.10.13, 6.11.2, 6.12Patch availableCNA
  • Linux VendorLinux Affected 5.4.273 to before 5.4.285; 5.10.214 to before 5.10.227; 5.15.153 to before 5.15.168; 6.1.83 to before 6.1.113; 6.6.23 to before 6.6.54; 6.7.11 to before 6.8; 6.8.2 to before 6.9 Fixed in 5.4.285, 5.10.227, 5.15.168, 6.1.113, 6.6.54, 6.8, 6.9 Patch available CNA
  • Linux VendorLinux Affected 6.9 and later Fixed in 5.4.285, 5.10.227, 5.15.168, 6.1.113, 6.6.54, 6.10.13, 6.11.2, 6.12 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*5.4.273 to before 5.5; 5.10.214 to before 5.10.227; 5.15.153 to before 5.15.168; 6.1.83 to before 6.1.113; 6.6.23 to before 6.6.54; 6.7.11 to before 6.8; 6.8.2 to before 6.9; after 6.9, before 6.10.13; 6.11 to before 6.11.2VulnerableLinux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 5.4.273 to before 5.5; 5.10.214 to before 5.10.227; 5.15.153 to before 5.15.168; 6.1.83 to before 6.1.113; 6.6.23 to before 6.6.54; 6.7.11 to before 6.8; 6.8.2 to before 6.9; after 6.9, before 6.10.13; 6.11 to before 6.11.2 Vulnerable ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 5.4.285, 5.10.227, 5.15.168, 6.1.113, 6.6.54, 6.8, 6.9
  • Fix · CNA Linux (Linux) Fixed in 5.4.285, 5.10.227, 5.15.168, 6.1.113, 6.6.54, 6.10.13, 6.11.2, 6.12

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-47712
  2. 2026-10-03 Alias added: GHSA-pgpc-54gc-3694

References

Patch 7

Other 1

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences