CVE-2024-53190

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures

Syzkaller reported a hung task with uevent_show() on stack trace. That

specific issue was addressed by another commit [0], but even with that

fix applied (for example, running v6.12-rc5) we face another type of hung

task that comes from the same reproducer [1]. By investigating that, we

could narrow it to the following path:

(a) Syzkaller emulates a Realtek USB WiFi adapter using raw-gadget and

dummy_hcd infrastructure.

(b) During the probe of rtl8192cu, the driver ends-up performing an efuse

read procedure (which is related to EEPROM load IIUC), and here lies the

issue: the function read_efuse() calls read_efuse_byte() many times, as

loop iterations depending on the efuse size (in our example, 512 in total).

This procedure for reading efuse bytes relies in a loop that performs an

I/O read up to *10k* times in case of failures. We mea

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References