5.5

CVE-2024-56539: linux

CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2024-56539DEBIAN-CVE-2024-56539
Published 27-12-2024Last modified 11-05-2026
Open JSON

Vulnerability summary

CVE-2024-56539 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 20.9% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.30%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 68 · Related 68
DLA-4075-1DLA-4076-1SUSE-SU-2025:0117-1SUSE-SU-2025:0152-1SUSE-SU-2025:0153-1SUSE-SU-2025:0154-1

Timeline

  1. 27-12-2024
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() Replace one-element array with a flexible-array member in `struct mwifiex_ie_types_wildcard_ssid_params` to fix the following warning on a MT8173 Chromebook (mt8173-elm-hana): [ 356.775250] ------------[ cut here ]------------ [ 356.784543] memcpy: detected field-spanning write (size 6) of single field "wildcard_ssid_tlv->ssid" at drivers/net/wireless/marvell/mwifiex/scan.c:904 (size 1) [ 356.813403] WARNING: CPU: 3 PID: 742 at drivers/net/wireless/marvell/mwifiex/scan.c:904 mwifiex_scan_networks+0x4fc/0xf28 [mwifiex] The "(size 6)" above is exactly the length of the SSID of the network this device was connected to. The source of the warning looks like: ssid_len = user_scan_in->ssid_list[i].ssid_len; [...] memcpy(wildcard_ssid_tlv->ssid, user_scan_in->ssid_list[i].ssid, ssid_len); There is a #define WILDCARD_SSID_TLV_MAX_SIZE that uses sizeof() on this struct, but it already didn't account for the size of the one-element array, so it doesn't need to be changed.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.30%

Chance of exploitation in the next 30 days

Percentile

21%

Versus all other CVEs

30-day change

0.00 pp

From 0.29% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.30%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu134 products
  • linuxAll versions (No fix recorded) | < 5.4.0-211.231 | < 5.15.0-135.146 | < 6.8.0-58.60
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.4.0-1142.152 | < 5.15.0-1080.87 | < 6.8.0-1027.29
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e, < a09760c513ae0f98c7082a1deace7fb6284ee866 | ≥ 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e, < 1de0ca1d7320a645ba2ee5954f64be08935b002a | ≥ 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e, < 5fa329c44e1e635da2541eab28b6cdb8464fc8d1 | ≥ 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e, < 581261b2d6fdb4237b24fa13f5a5f87bf2861f2c | ≥ 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e, < b466746cfb6be43f9a1457bbee52ade397fb23ea | ≥ 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e, < c4698ef8c42e02782604bf4f8a489dbf6b0c1365 | ≥ 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e, < e2de22e4b6213371d9e76f74a10ce817572a8d74 | ≥ 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e, < d7774910c5583e61c5fe2571280366624ef48036 | ≥ 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e, < d241a139c2e9f8a479f25c75ebd5391e6a448500 | 3.0
  • linux_kernel≥ 3.0, < 4.19.325 | ≥ 4.20, < 5.4.287 | ≥ 5.5, < 5.10.231 | ≥ 5.11, < 5.15.174 | ≥ 5.16, < 6.1.120 | ≥ 6.2, < 6.6.64 | ≥ 6.7, < 6.11.11 | ≥ 6.12, < 6.12.2
Debian1 product
  • linux< 6.1.123-1 | < 6.12.3-1

3 vendors · 137 products

References

49 links
Show all 49 references