NULL-pointer Dereference in MediaTek MT76 WiFi Driver

Executive Summary

This is a NULL-pointer dereference vulnerability in the Linux kernel's mt76 WiFi driver, specifically affecting the mt7925 chipset. The issue occurs in the mt7925_mcu_bss_he_tlv function where a pointer returned by mt76_connac_get_he_phy_cap is not checked before being used. If the pointer is NULL, attempting to dereference it could lead to a system crash or other undefined behavior.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the Linux kernel's mt76 driver for the mt7925 chipset. Detection requires checking the kernel version and loaded modules. Use 'uname -r' to check the kernel version and 'lsmod | grep mt76' to verify if the mt76 module is loaded. If the module is loaded, check for crashes or NULL pointer dereference errors in system logs using 'dmesg | grep mt76' or 'journalctl -k | grep mt76'.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could cause a kernel panic or system instability, potentially leading to denial of service. It may also allow an attacker to execute arbitrary code with kernel privileges if they can trigger the NULL-pointer dereference through crafted network traffic.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vulnerability. If updating is not immediately possible, consider disabling the mt76 driver module using 'modprobe -r mt76' if it is not critical for your system. Monitor vendor advisories for kernel updates and apply them promptly.

Useful 0 Not Useful 0