#VU106135 Memory leak in Linux kernel - CVE-2023-53028

Vulnerability identifier: #VU106135

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-53028

CWE-ID: CWE-401

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ieee80211_if_add() function in net/mac80211/iface.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: 6.1, 6.1 rc1, 6.1 rc3, 6.1 rc7, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7

---

External links
https://git.kernel.org/stable/c/71e5cd1018d345e649e63f74a56c1897f99db7e9
https://git.kernel.org/stable/c/80f8a66dede0a4b4e9e846765a97809c6fe49ce5
https://git.kernel.org/stable/c/982c8b1e95c088f5d8f65967ec25be66e961401c
https://git.kernel.org/stable/c/effecd8d116d3d3a28b4f628e61bba8d318fdfcf
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.8

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.