CVE-2024-38572: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-38572 affects the Linux kernel's ath12k WiFi driver, specifically related to an out-of-bounds access vulnerability in the qmiinvokehandler() function. The issue was discovered in June 2024 and affects various Linux distributions including Ubuntu 24.04 LTS and related kernel versions (Ubuntu Security).

The vulnerability stems from a missing terminator entry in the ath12kqmimsghandlers array, which leads to a global out-of-bounds read in the qmiinvoke_handler() function. This results in a KASAN (Kernel Address Sanitizer) warning when accessing memory beyond the array boundaries. The issue specifically involves an 8-byte read at an unauthorized address by the kernel worker thread (Kernel Commit).

The vulnerability could potentially allow an attacker to access memory outside of intended boundaries in the Linux kernel's WiFi driver implementation. This could lead to information disclosure or potential system instability (Ubuntu Security).

The issue has been fixed by adding a dummy terminator entry at the end of the ath12kqmimsg_handlers array to prevent out-of-boundary access. Updates are available for affected systems, including Ubuntu 24.04 LTS (noble) with kernel version 6.8.0-40.40 and various other kernel variants. Users should update their systems to the patched versions (Ubuntu Security).