CVE-2024-53190

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12-rc5

Description A vulnerability in the Linux kernel has been resolved, related to the wifi: rtlwifi driver. The issue arises when the driver attempts to read efuse in case of failures, resulting in a hung task. The function read efuse() calls read efuse byte() many times, leading to a loop that performs an I/O read up to 10,000 times in case of failures. This causes the driver to become stuck in its probe routine, exposing a stack trace. The vulnerability was reported by Syzkaller and has been addressed by reducing the attempts to read efuse in case of failures, restricted to USB devices.

Recommendations To resolve the issue, update to a version of the Linux kernel that includes the fix, such as version 6.12-rc5 or later. As a temporary workaround, consider disabling the read efuse() function until a patch is available. Restrict access to the vulnerable rtlwifi driver to minimize the risk of exploitation. Avoid using the read efuse byte() function in the affected driver until the issue is resolved.