CVE-2024-35845: Linux Kernel Buffer Overflow Vulnerability

CVE-2024-35845 Overview

CVE-2024-35845 affects the Linux kernel's Intel wireless (iwlwifi) driver. The iwl_fw_ini_debug_info_tlv structure is treated as a string but lacks guaranteed NUL termination before use. This format string handling issue [CWE-134] can lead to out-of-bounds reads when the kernel processes debug Type-Length-Value (TLV) data from firmware. The flaw impacts mainline Linux kernel builds and downstream distributions including Debian. Siemens has also issued an advisory covering affected industrial products.

Critical Impact
A network-adjacent attacker can trigger out-of-bounds memory reads or kernel crashes through crafted firmware debug data, resulting in confidentiality compromise and denial of service on affected systems.

Affected Products

Linux kernel (multiple stable branches prior to the fixing commits)
Debian Linux 10.0 and related LTS releases
Siemens industrial products bundling the affected kernel (see Siemens Security Advisory)

Discovery Timeline

2024-05-17 - CVE-2024-35845 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2024-35845

Vulnerability Analysis

The vulnerability resides in the iwlwifi debug TLV parser within the Linux kernel wireless subsystem. The driver consumes the iwl_fw_ini_debug_info_tlv structure and passes its embedded character buffer to string handling routines. Because the buffer was not guaranteed to contain a terminating NUL byte, downstream strlen, printk, or snprintf operations read past the structure boundary. This produces information disclosure, kernel log corruption, or a kernel oops depending on adjacent memory contents.

The weakness is classified under [CWE-134] (Use of Externally-Controlled Format String) because attacker-influenced firmware metadata flows into string formatting paths without sanitization. The fix, distributed across kernel commits 71d4186d, 783d413f, 96aa4076, c855a1a5, ea1d166f, fabe2db7, and fec14d1c, forces explicit NUL termination of the string field before any further processing.

Root Cause

The iwl_fw_ini_debug_info_tlv is a fixed-size structure that the kernel reads from firmware debug TLV payloads. The original parser trusted that the embedded debug_cfg_name array contained a properly terminated C string. When firmware or a crafted debug image supplies a non-terminated payload, kernel string functions iterate beyond the buffer until they encounter an unrelated NUL byte in adjacent memory.

Attack Vector

The vulnerability is reachable through firmware loading and debug TLV ingestion paths. An adversary capable of supplying or influencing the iwlwifi firmware debug configuration can trigger the out-of-bounds read. Exposure depends on whether unprivileged firmware loading or debug TLV submission is possible on the target system, including via supply chain or local privileged code paths that feed crafted TLVs to the driver.

The vulnerability mechanism is documented in the upstream patch series. Refer to Kernel Commit 96aa4076 for the canonical fix and the Debian LTS Announcement for distribution-level details.

Detection Methods for CVE-2024-35845

Indicators of Compromise

Unexpected kernel oops or stack traces referencing iwl_fw_ini_debug_info_tlv or iwlwifi debug TLV parsing functions
Anomalous dmesg entries containing malformed or non-printable characters near iwlwifi debug configuration messages
Unscheduled Wi-Fi driver restarts or firmware reload events on Intel wireless hardware

Detection Strategies

Inventory running kernel versions against the fixing commits listed in the kernel.org stable tree to identify unpatched hosts
Monitor system logs for crashes within the iwlwifi module, particularly during firmware load or debug TLV ingestion
Correlate Wi-Fi adapter reset events with concurrent memory corruption indicators on Linux endpoints

Monitoring Recommendations

Forward kernel ring buffer (dmesg) and journald entries to a centralized log platform for crash signature analysis
Alert on repeated iwlwifi driver faults across multiple endpoints, which may indicate a coordinated attempt to trigger the flaw
Track package versions of linux-image-* across the fleet and flag hosts running pre-patch kernels

How to Mitigate CVE-2024-35845

Immediate Actions Required

Apply the latest stable kernel update from your distribution that incorporates the upstream iwlwifi dbg-tlv NUL termination fix
Prioritize patching on systems with Intel wireless hardware and on industrial endpoints covered by the Siemens Security Advisory
Verify Debian systems are upgraded per the Debian LTS Announcement

Patch Information

The fix is committed upstream across seven stable branches. Reference commits include 71d4186d470e, 783d413f332a, 96aa40761673, c855a1a5b7e3, ea1d166fae14, fabe2db7de32, and fec14d1cdd92. Each commit ensures the iwl_fw_ini_debug_info_tlv string is explicitly terminated before being passed to string handling functions. Linux distributions including Debian have backported the change to supported kernels.

Workarounds

Unload the iwlwifi module on systems that do not require Intel wireless connectivity until patches are applied
Disable iwlwifi firmware debug TLV loading where operationally feasible to reduce attacker-influenced input to the parser
Restrict physical and local privileged access to systems running unpatched kernels to limit firmware load paths

bash

# Verify installed kernel and unload iwlwifi if not needed
uname -r
sudo modprobe -r iwlwifi

# On Debian-based systems, apply security updates
sudo apt-get update && sudo apt-get upgrade linux-image-$(uname -r | cut -d- -f3-)