Description
The iwl_set_rate function in compatible/iwl3945-base.c in iwlwifi 1.1.21 and earlier dereferences an iwl_get_hw_mode return value without checking for NULL, which might allow remote attackers to cause a denial of service (kernel panic) via unspecified vectors during module initialization.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-53.1.14.el5 | RHSA-2008:0154 |
Advisories 1
- RHSA-2008:0154 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- http://bugs.gentoo.org/show_bug.cgi?id=199209
- RHSA-2008:0154 vendor-advisory
- 44749 vdb-entry
- ADV-2007-4211 vdb-entry
- oval:org.mitre.oval:def:10787 vdb-entry signature
- 29236 third-party-advisory
- 26842 vdb-entry
- http://article.gmane.org/gmane.linux.drivers.ipw3945.devel/1618
- http://www.intellinuxwireless.org/repos/?p=iwlwifi.git%3Ba=commitdiff%3Bh=25db44d4cdfe31d59223d74cb577f4a71aff1a40