Security readout for executives and security teams
Plain-English summary
CVE-2024-38572 is a Linux kernel flaw in the ath12k Wi-Fi driver. A missing terminator in a QMI message handler table can make kernel code read past the intended handler list. The public record shows a KASAN global out-of-bounds warning and kernel stable fixes, but no CVSS score or confirmed exploitation.
Executive priority
Treat as a targeted Linux kernel maintenance issue, not an emergency from the available evidence. Prioritize patching laptops, appliances, or embedded systems using affected Qualcomm Wi-Fi hardware, and track vendor kernel advisories because public severity and impact details are incomplete.
Technical view
The ath12k_qmi_msg_handlers table lacked a dummy terminator, causing qmi_invoke_handler() to continue traversal and perform a global out-of-bounds read. The fix adds the terminator entry. The issue was tested on QCN9274 hw2.0 PCI hardware. Affected exposure depends on kernels carrying the ath12k driver and related Qualcomm Wi-Fi hardware support.
Likely exposure
Most relevant to Linux systems using ath12k-supported Qualcomm Wi-Fi hardware, especially kernels in affected upstream or downstream ranges before the stable fixes. Servers without this driver loaded or hardware present are less likely exposed. Distribution backports may change exposure and should be checked directly.
Exploitation context
The provided sources do not show active exploitation, public exploit code, or KEV listing. The evidence is a kernel KASAN report showing out-of-bounds read behavior during QMI message handling. Practical impact is not fully characterized in the supplied sources.
Researcher notes
The root cause is table traversal without a terminator in ath12k QMI handler registration. The source record identifies stable commits but does not provide CVSS, CWE, attacker prerequisites, or impact beyond the KASAN out-of-bounds read. Validate against the actual downstream kernel source, not just upstream version labels.
Mitigation direction
- Update to a vendor kernel containing the referenced stable ath12k fixes.
- Confirm distribution advisories for backported fixes before relying on version numbers alone.
- If feasible, avoid loading ath12k on systems that do not need it.
- Prioritize systems with Qualcomm ath12k Wi-Fi hardware or exposed wireless roles.
Validation and detection
- Inventory Linux kernels and check whether the ath12k module is present or loaded.
- Identify systems with Qualcomm ath12k-supported Wi-Fi hardware.
- Compare kernel package changelogs against the referenced stable commits.
- Review kernel logs for ath12k, QMI, KASAN, or crash signatures.
- Verify remediated systems are running a fixed vendor kernel build.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-38572 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/95575de7dede7b1ed3b9718dab9dda97914ea775CVE reference, Linux
- https://git.kernel.org/stable/c/b48d40f5840c505b7af700594aa8379eec28e925CVE reference, Linux
- https://git.kernel.org/stable/c/a1abdb63628b04855a929850772de97435ed1555CVE reference, Linux
- https://git.kernel.org/stable/c/e1bdff48a1bb4a4ac660c19c55a820968c48b3f2CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.