CVE-2024-47672: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-47672 affects the Linux kernel's iwlwifi driver, specifically the mvm (modular virtualization) component. The vulnerability was discovered in the handling of TX queues when firmware becomes non-responsive. The issue affects Linux kernel versions from 5.10.227 up to (excluding) 6.1.112, from 6.2 up to (excluding) 6.6.53, from 6.7 up to (excluding) 6.10.12, and various 6.11 release candidates (NVD).

The vulnerability stems from a WARNING condition in the iwltranswaittxqueues_empty() function that occurs when attempting to wait for TX queues to become empty after firmware has died. The issue arises because the system continues to wait for a response from non-functioning firmware. The CVSS v3.1 base score is 5.5 (MEDIUM) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access required and potential for high availability impact (NVD).

The vulnerability can lead to a system warning and potential denial of service condition when the iwlwifi driver attempts to interact with non-responsive firmware. This primarily affects system availability by causing unnecessary waits for responses from dead firmware (NVD).

The issue has been patched by modifying the driver to check for firmware status before waiting for TX queues to empty. The fix involves adding a condition to prevent calling iwltranswaittxqueues_empty() when the firmware is dead, while maintaining other necessary maintenance operations. Updates are available through various Linux distribution channels (Kernel Patch).