Listen to this Post
This vulnerability exists in the `wl1251` WiFi driver within the Linux kernel. During the transmission process, the driver’s `wl1251_tx_work` function dequeues a socket buffer (skb) for processing. It first attempts to wake the device from power-save mode by calling wl1251_ps_elp_wakeup. If this wakeup call fails with a `-ETIMEDOUT` error, the function returns early due to the error. The critical flaw is that the already-dequeued `skb` is not handled in this error path; it is neither transmitted nor freed, nor is it placed back on the transmission queue. This results in the `skb` being permanently lost from the system’s tracking, causing a memory leak. Each occurrence consumes kernel memory that is never reclaimed. Repeated timeouts can exhaust available kernel memory resources, potentially leading to a system denial-of-service. The fix is to re-queue the `skb` back to the `tx_queue` when the wakeup operation fails.
dailycve form:
Platform: Linux Kernel
Version: wl1251 driver
Vulnerability: Memory Leak
Severity: Medium
date: 2025-05-20
Prediction: 2025-04-10
What Undercode Say:
git log --oneline --grep="wl1251" --after="2025-03-01" cat drivers/net/wireless/ti/wl1251/main.c | grep -A 20 -B 5 "wl1251_tx_work" dmesg | grep -i "wl1251|oom|out of memory" sudo modprobe -r wl1251_sdio && sudo modprobe wl1251_sdio
How Exploit:
An attacker with local access can trigger the wakeup timeout condition repeatedly, causing the driver to leak kernel memory. This is achieved by forcing the Wi-Fi chip into a state where it does not respond to wakeup requests, or by manipulating power management events. Each failed transmission attempt due to the timeout will leak one skb. Sustained attack leads to kernel memory exhaustion, causing system instability or a full denial-of-service crash.
Protection from this CVE:
Update Linux kernel. Apply patch. Remove vulnerable module.
Impact:
Local Denial-of-Service. Resource Exhaustion. Kernel Memory Leak.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
