CVE-2023-54025

Vulnerability

In the Linux kernel's rsi WiFi driver, the shutdown hook unconditionally calls rsi_config_wowlan() without first verifying that WoWlan (Wake-on-WLAN) was ever configured during the device's operation. The function rsi_config_wowlan() expects a non-NULL wowlan_config pointer and issues a kernel warning if it is NULL is passed. This leads to a spurious warning and potential system instability during shutdown when WoWlan has not been enabled by the user [1].

Exploitation

An attacker does not need to trigger this vulnerability remotely; it is a local denial-of-service condition that can be provoked by simply shutting down a system running the affected kernel with the rsi driver loaded. No special privileges are required beyond the ability to initiate a system shutdown. The attack surface is limited to systems that use the rsi WiFi driver and have not configured WoWlan [2].

Impact

If the system is shut down without WoWlan having been configured, the kernel will emit a WARN() message and may panic or hang depending on the kernel configuration. This can lead to a denial of service, preventing a clean shutdown and potentially causing data loss or requiring a hard reset [3].".

Mitigation

The fix adds a check for CVE-2023-54025 adds a check for non-NULL wowlan_config before calling rsi_config_wowlan() in the shutdown hook, and also verifies that wiphy is non-NULL before accessing wowlan_config. The patch has been applied to the stable kernel tree [3]. Users should update to a kernel version containing this commit to avoid the issue.