Executive brief
A vulnerability in the Linux kernel's Realtek Wi-Fi driver could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when the driver is stopped while certain background tasks are still running, leading to memory corruption. This affects systems using specific Realtek wireless adapters.
Technical details
A use-after-free (UAF) vulnerability exists in the rtl8xxxu wireless driver within the Linux kernel. The root cause is a lack of synchronization in the rtl8xxxu_stop() function, which fails to cancel the 'c2hcmd_work' workqueue before the driver shuts down. If the workqueue is still executing when the driver is stopped and its resources are freed, the kernel may attempt to access previously allocated memory that has been released. This local vulnerability requires high architectural complexity to exploit but can result in a kernel panic (Denial of Service) or arbitrary code execution. Patches have been released across multiple stable kernel branches to include the missing cancel_work_sync() call.
Affected products
- Linux Linux Kernel 5.5 to 5.10.214, 5.11 to 5.15.153, 5.16 to 6.1.83, 6.2 to 6.6.23, 6.7 to 6.7.11, 6.8 to 6.8.2
Timeline
- 2024-01-11: patched: Initial patch authored by Martin Kaistra
- 2024-05-01: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1213acb478a7181cd73eeaf00db430f1e45b1361
- https://git.kernel.org/stable/c/156012667b85ca7305cb363790d3ae8519a6f41e
- https://git.kernel.org/stable/c/3518cea837de4d106efa84ddac18a07b6de1384e
- https://git.kernel.org/stable/c/58fe3bbddfec10c6b216096d8c0e517cd8463e3a
- https://git.kernel.org/stable/c/7059cdb69f8e1a2707dd1e2f363348b507ed7707
- https://git.kernel.org/stable/c/ac512507ac89c01ed6cd4ca53032f52cdb23ea59
- https://git.kernel.org/stable/c/dddedfa3b29a63c2ca4336663806a6128b8545b4