CVE-2024-47712
mediumpriority · track · 22EPSS 0.004 · 30 %ileDEEURUUSEPSS · scored 2026-10-27
In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param In the `wilc_parse_join_bss_param` function, the TSF field of the `ies` structure is accessed after the RCU read-side critical section is unlocked. According to RCU usage rules, this is illegal. Reusing this pointer can lead to unpredictable behavior, including accessing memory that has been updated or causing use-after-free issues. This possible bug was identified using a static analysis tool developed by myself, specifically designed to detect RCU-related issues. To address this, the TSF value is now stored in a local variable `ies_tsf` before the RCU lock is released. The `param->tsf_lo` field is then assigned using this local variable, ensuring that the TSF value is safely accessed.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.1–8.3
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (133)
Products and version ranges known to be affected.
- NetApp AFF Baseboard Management Controllerall versionscert_bundDEcpe:/h:netapp:aff:::baseboard_management_controller
- NetApp ActiveIQ Unified Manager for VMware vSphereall versionscert_bundDEcpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere
- NetApp FAS Baseboard Management Controllerall versionscert_bundDEcpe:/h:netapp:fas:baseboard_management_controller
advisories (3)
Vendor and ecosystem advisories describing this.
- SSA-355557SSA-355557: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.22025-08-12csaf · siemens_psirtDE
SINEC OS before V3.2 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
- WID-SEC-W-2024-3251Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2024-10-21csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder andere, nicht näher bekannte Auswirkungen zu erzielen..
- ICSA-25-226-07Siemens Third-Party Components in SINEC OS2025-08-12icsa · cisa_csaf_otUS
SINEC OS before V3.2 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (27)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2024-47712cnnvd
- https://git.kernel.org/stable/c/2f944e6255c2fc1c9bd9ee32f6b14ee0b2a51eb5cnnvd
- https://git.kernel.org/stable/c/557418e1704605a81c9e26732449f71b1d40ba1ecnnvd
- https://git.kernel.org/stable/c/6d7c6ae1efb1ff68bc01d79d94fdf0388f86cdd8cnnvd
- https://git.kernel.org/stable/c/79510414a7626317f13cc9073244ab7a8deb3192cnnvd
- https://git.kernel.org/stable/c/84398204c5df5aaf89453056cf0647cda9664d2bcnnvd
- https://git.kernel.org/stable/c/b040b71d99ee5e17bb7a743dc01cbfcae8908ce1cnnvd
- https://git.kernel.org/stable/c/bf090f4fe935294361eabd9dc5a949fdd77d3d1bcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan