CVE-2023-53767

Vulnerability

In the Linux kernel's ath12k WiFi driver, a memory leak exists in the ath12k_qmi_driver_event_work() function. When the ATH12Kernel's ATH12K_FLAG_UNREGISTERING flag is set, the function returns early without freeing the event` buffer, leading to a memory leak [1].

Exploitation

This vulnerability is triggered during driver unregistration or removal, when the ATH12K_FLAG_UNREGISTERING bit is set. An attacker would need to be able to trigger driver unload or device removal, which typically requires local access or the system or the ability to hot-unplug the device. No special privileges are required beyond the ability to cause the driver to unregister.

Impact

An attacker who can repeatedly trigger the driver unregistration path can cause a memory leak, potentially leading to system memory exhaustion and denial of service. The leak is limited to the event buffer allocated in the QMI driver event workqueue.

Mitigation

The fix is to replace the early return with a goto skip that ensures the event buffer and all list entries are properly freed before returning. The patch has been applied to the Linux kernel stable tree [1]. Users should update to a kernel version containing the fix.