CVE-2024-27434 (Medium) detected in freebsd-srce72d86ad9c62c8054d7977a71f08e68ef755c132

[mend-bolt-for-github]

CVE-2024-27434 - Medium Severity Vulnerability

Vulnerable Library - freebsd-srce72d86ad9c62c8054d7977a71f08e68ef755c132

The FreeBSD src tree publish-only repository. Experimenting with 'simple' pull requests....

Library home page: https://github.com/freebsd/freebsd-src.git

Found in HEAD commit: 816463d989cc5839c1cca2efb5bf2503408507fb

Found in base branch: master

Vulnerable Source Files (1)

/sys/contrib/dev/iwlwifi/mvm/mld-key.c

Vulnerability Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: don't set the MFP flag for the GTK

The firmware doesn't need the MFP flag for the GTK, it can even make the
firmware crash. in case the AP is configured with: group cipher TKIP and
MFPC. We would send the GTK with cipher = TKIP and MFP which is of course
not possible.

Publish Date: 2024-05-17

URL: CVE-2024-27434

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://git.kernel.org/stable/c/40405cbb20eb6541c603e7b3d54ade0a7be9d715

Release Date: 2024-05-17

Fix Resolution: v6.6.23,v6.7.11,v6.8.2,v6.9

---

Step up your Open Source Security Game with Mend here

[mend-bolt-for-github]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-bolt-for-github]

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.

[mend-bolt-for-github]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-bolt-for-github]

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.

[mend-bolt-for-github]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-bolt-for-github]

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.