CVE-2024-43842: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-43842 is a vulnerability discovered in the Linux kernel's rtw89 WiFi driver. The issue was identified in the rtw89_sta_info_get_iter() function where an array index mistake could lead to out-of-bounds access. The vulnerability affects Linux kernel versions from 5.16 up to (excluding) 6.1.103, from 6.2 up to (excluding) 6.6.44, and from 6.7 up to (excluding) 6.10.3 (NVD).

The vulnerability stems from an array indexing error in the rtw89_sta_info_get_iter() function of the Realtek 802.11ax driver. Specifically, while 'status->he_gi' is compared to the array size, 'rate->he_gi' is incorrectly used as the array index instead of 'status->he_gi'. This can result in accessing memory beyond array boundaries if 'rate->he_gi' is not equal to 'status->he_gi' and exceeds the array size. The issue has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could potentially lead to memory access violations in the Linux kernel when using the affected Realtek WiFi driver. This could result in system crashes or potential information disclosure due to improper array boundary checking (NVD).

The vulnerability requires local access and low privileges to exploit. It was discovered through static analysis by the Linux Verification Center using their SVACE tool (Kernel Patch).

The issue has been fixed by replacing 'rate->he_gi' with 'status->he_gi' in the affected code. The fix has been implemented in multiple kernel versions through patches. Users should update their Linux kernel to versions 6.1.103 or later, 6.6.44 or later, or 6.10.3 or later to address this vulnerability (NVD).