VYPR
← All advisories
High severity7.1NVD Advisory· Published Feb 27, 2025· Updated May 12, 2026

CVE-2024-58014

CVE-2024-58014

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()

In 'wlc_phy_iqcal_gainparams_nphy()', add gain range check to WARN() instead of possible out-of-bounds 'tbl_iqcal_gainparams_nphy' access. Compile tested only.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel's brcmsmac WiFi driver, a missing gain range check in wlc_phy_iqcal_gainparams_nphy() could lead to an out-of-bounds array access, fixed by adding a WARN().

Vulnerability

Details

A vulnerability was found in the Linux kernel's Broadcom BCM43xx WiFi driver (brcmsmac). The function wlc_phy_iqcal_gainparams_nphy() lacked a range check on the gain parameter before using it as an index into the tbl_iqcal_gainparams_nphy lookup table. This could result in an out-of-bounds memory read, potentially leaking sensitive kernel memory or causing a system crash [1]. The issue was discovered by the Linux Verification Center (linuxtesting.org) using the SVACE static analysis tool [1].

Exploitation

To exploit this vulnerability, an attacker would need to trigger the IQ calibration path in the N-PHY layer of the brcmsmac driver. This typically requires local access to the system and the ability to send crafted wireless frames or manipulate driver state to reach the vulnerable code path. No authentication is strictly required if a local user can interact with the driver through the wireless subsystem, but network-level exploitation is improbable due to the local nature of the driver interface [1].

Impact

Successful exploitation could lead to an out-of-bounds read from the tbl_iqcal_gainparams_nphy array, which may expose sensitive kernel data or cause a denial-of-service condition (kernel panic). The CVSS v3 base score of 7.1 (High) reflects the potential for high confidentiality impact, though the attack complexity is high and privileges are required [1].

Mitigation

The fix adds a range check that triggers a WARN() if the gain value is out of bounds, preventing the out-of-bounds access. The patch is already merged into the Linux kernel stable tree [2][3][4]. Users should apply the latest kernel updates from their distribution or directly backport the commit. Siemens has also listed this CVE in their advisory SSA-265688 for affected SIMATIC S7-1500 TM MFP devices with the GNU/Linux subsystem [1].

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

273

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.