CVE-2024-50008

wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() Replace one-element array with a flexible-array member in `struct host_cmd_ds_802_11_scan_ext`. With this, fix the following warning: elo 16 17:51:58 surfacebook kernel: ------------[ cut here ]------------ elo 16 17:51:58 surfacebook kernel: memcpy: detected field-spanning write (size 243) of single field "ext_scan->tlv_buffer" at drivers/net/wireless/marvell/mwifiex/scan.c:2239 (size 1) elo 16 17:51:58 surfacebook kernel: WARNING: CPU: 0 PID: 498 at drivers/net/wireless/marvell/mwifiex/scan.c:2239 mwifiex_cmd_802_11_scan_ext+0x83/0x90 [mwifiex]

5.5
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.03%
Affected: Linux Linux
Affected: Linux Linux
Published at:
Updated at:

References

Link Tags
https://git.kernel.org/stable/c/b55c8848fdc81514ec047b2a0ec782ffe9ab5323
https://git.kernel.org/stable/c/f9310a6704bf52e2493480edea896e1f9b795d40
https://git.kernel.org/stable/c/1756918f51e9ab247a0f4782cc28853c2bb457c1 patch
https://git.kernel.org/stable/c/e59bdb1ba594104cd0ee0af3ee9e4435d842a8fe patch
https://git.kernel.org/stable/c/17199b69a84798efffc475040fbef44374ef1de1 patch
https://git.kernel.org/stable/c/fef7b51f22cf2049b0ca6740adeb0ba6f2e671dc patch
https://git.kernel.org/stable/c/71267bd4e8c752d7af6c6b96bb83984a6a95273d patch
https://git.kernel.org/stable/c/a3a12c30f9510f3753286fadbc6cdb7dad78c1d5 patch
https://git.kernel.org/stable/c/498365e52bebcbc36a93279fe7e9d6aec8479cee patch

Frequently Asked Questions

What is the severity of CVE-2024-50008?
CVE-2024-50008 has been scored as a medium severity vulnerability.
How to fix CVE-2024-50008?
To fix CVE-2024-50008, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-50008 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2024-50008 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-50008?
CVE-2024-50008 affects Linux Linux, Linux Linux.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.