CVE-2024-58063: wifi: rtlwifi: fix memory leaks and invalid access at probe error path
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtlwifi: fix memory leaks and invalid access at probe error path
Deinitialize at reverse order when probe fails.
When initswvars fails, rtldeinitcore should not be called, specially now that it destroys the rtlwq workqueue.
And call rtlpcideinit and deinitswvars, otherwise, memory will be leaked.
Remove pcisetdrvdata call as it will already be cleaned up by the core driver code and could lead to memory leaks too. cf. commit 8d450935ae7f ("wireless: rtlwifi: remove unnecessary pcisetdrvdata()") and commit 3d86b93064c7 ("rtlwifi: Fix PCI probe error path orphaned memory").
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.13-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
ubuntu/linux-aws-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1146.156~18.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1151.158~18.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1149.158~18.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-216.236~18.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1092.97~18.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1144.154~18.04.1 - Upgrade
Upgrade
ubuntu/linux-raspi-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1129.142~18.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.4.0-216.236 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.4.0-1146.156 - Upgrade
Upgrade
ubuntu/linux-aws-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1084.91~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.4.0-1151.158 - Upgrade
Upgrade
ubuntu/linux-azure-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1089.98~20.04.1 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 5.4.0-1105.112 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.4.0-1149.158 - Upgrade
Upgrade
ubuntu/linux-gcp-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1083.92~20.04.1 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.4.0-1092.97 - Upgrade
Upgrade
ubuntu/linux-ibm-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1076.79~20.04.1 - Upgrade
Upgrade
ubuntu/linux-intel-iotg-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1079.85~20.04.1 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.4.0-1133.142 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-140.150~20.04.1 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.4.0-1144.154 - Upgrade
Upgrade
ubuntu/linux-oracle-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1081.87~20.04.1 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 5.4.0-1129.142 - Upgrade
Upgrade
ubuntu/linux-riscv-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1079.83~20.04.1 - Upgrade
Upgrade
ubuntu/linux-xilinx-zynqmpto a version that resolves this vulnerability.Fixed in 5.4.0-1064.68 - Upgrade
Upgrade
ubuntu/linux-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-142.152~20.04.1 - Upgrade
Upgrade
ubuntu/linux-iotto a version that resolves this vulnerability.Fixed in 5.4.0-1051.54 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegra-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1039.39~20.04.1 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1146.156+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1151.158+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1120.130 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1149.158+fips1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.15.0-140.150 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.15.0-1084.91 - Upgrade
Upgrade
ubuntu/linux-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1032.34~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.15.0-1089.98 - Upgrade
Upgrade
ubuntu/linux-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1034.39~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 5.15.0-1089.98.1 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.15.0-1083.92 - Upgrade
Upgrade
ubuntu/linux-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1033.35~22.04.1 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.15.0-1081.87 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.15.0-1066.74 - Upgrade
Upgrade
ubuntu/linux-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-64.67~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.15.0-1076.79 - Upgrade
Upgrade
ubuntu/linux-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1029.29~22.04.1 - Upgrade
Upgrade
ubuntu/linux-intel-iotgto a version that resolves this vulnerability.Fixed in 5.15.0-1079.85 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.15.0-1080.85 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 5.15.0-140.150 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-64.67.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 5.15.0-1078.79 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1031.34~22.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 5.15.0-1037.37 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegra-igxto a version that resolves this vulnerability.Fixed in 5.15.0-1026.26 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.15.0-1081.87 - Upgrade
Upgrade
ubuntu/linux-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1029.30~22.04.1 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 5.15.0-1078.81 - Upgrade
Upgrade
ubuntu/linux-riscv-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-64.67~22.04.1 - Upgrade
Upgrade
ubuntu/linux-xilinx-zynqmpto a version that resolves this vulnerability.Fixed in 5.15.0-1050.54 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 5.15.0-1066.68 - Upgrade
Upgrade
ubuntu/linux-intel-iot-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1077.79 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1084.93 - Upgrade
Upgrade
ubuntu/linux-realtime-6.8to a version that resolves this vulnerability.Fixed in 6.8.1-1025.26~22.04.1 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1084.91+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1089.98+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-140.150+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1083.92+fips1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-64.67 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1032.34 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1034.39 - Upgrade
Upgrade
ubuntu/linux-azure-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1015.15~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1022.23 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1033.35 - Upgrade
Upgrade
ubuntu/linux-gcp-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1015.15~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1028.32 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1015.17 - Upgrade
Upgrade
ubuntu/linux-hwe-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-26.26~24.04.1 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1029.29 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-64.67.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1014.15~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1031.34 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-nvidia-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-1031.34.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-oem-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1022.22 - Upgrade
Upgrade
ubuntu/linux-oem-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1031.31 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1029.30 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1031.35 - Upgrade
Upgrade
ubuntu/linux-xilinxto a version that resolves this vulnerability.Fixed in 6.8.0-1017.18 - Upgrade
Upgrade
ubuntu/linux-raspi-realtimeto a version that resolves this vulnerability.Fixed in 6.8.0-2026.27 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1025.26 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-78.78+fips1 - Compensating control
Remove the unnecessary pci_set_drvdata() call from the rtlwifi PCI driver; the core driver code already cleans it up and retaining the call can cause memory leaks.
- Compensating control
When the rtlwifi probe fails, deinitialize in reverse order and call rtl_pci_deinit() and deinit_sw_vars() to prevent memory leaks.
- Compensating control
When init_sw_vars() fails, do not call rtl_deinit_core(), because it destroys the rtl_wq workqueue and can cause invalid access.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58063?
CVE-2024-58063 has been classified as low severity due to its nature of memory leaks and invalid access that primarily affects system stability.
How do I fix CVE-2024-58063?
To mitigate CVE-2024-58063, ensure your Linux kernel is updated to the latest stable version where this vulnerability has been resolved.
What systems are affected by CVE-2024-58063?
CVE-2024-58063 affects Linux kernel versions utilized in various distributions that include rtlwifi drivers.
What is the impact of CVE-2024-58063?
The impact of CVE-2024-58063 includes potential memory leaks and unstable behavior when the probe process fails.
Is CVE-2024-58063 remotely exploitable?
CVE-2024-58063 is not considered remotely exploitable as it primarily affects internal memory management during driver initialization.