Executive brief
The Linux kernel's vt6655 wireless driver contains a memory leak in its device initialization routine. When memory allocation fails during setup of transmit descriptor rings, the cleanup code fails to free one allocated memory block, causing a resource leak. While not directly exploitable for code execution, this leak can be triggered repeatedly to exhaust system memory and cause denial of service.
Technical details
The vulnerability is a resource leak in the device_init_td0_ring() function in drivers/staging/vt6655/device_main.c. The function allocates memory for td_info members in an array loop (i=0 to N). On allocation failure, the error handler attempts to free previously allocated memory in reverse order using a while(--i) loop, but this pre-decrements i before checking, causing the loop to skip the i=0 case and leak that allocation. The fix changes the loop condition from while(--i) to while(i--), allowing the post-decrement to include i=0 in the cleanup. The vulnerability affects staging driver code and requires local system access to trigger repeated allocations and cause denial of service through memory exhaustion.
Affected products
- Linux Linux Kernel affected versions prior to patch commit c8ff91535880d41b49699b3829fb6151942de29e
Timeline
- 2022-09-09: disclosed: Patch submitted by Nam Cao
- 2022-10-26: patched: Merged into Linux kernel stable trees