CVE-2022-50513
MEDIUMCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Description
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv() In rtw_init_cmd_priv(), if `pcmdpriv->rsp_allocated_buf` is allocated in failure, then `pcmdpriv->cmd_allocated_buf` will be not properly released. Besides, considering there are only two error paths and the first one can directly return, so we do not need implicitly jump to the `exit` tag to execute the error handler. So this patch added `kfree(pcmdpriv->cmd_allocated_buf);` on the error path to release the resource and simplified the return logic of rtw_init_cmd_priv(). As there is no proper device to test with, no runtime testing was performed.
Analysis
A memory leak vulnerability exists in the Linux kernel's rtl8723bs WiFi driver initialization function rtw_init_cmd_priv(), where failure to allocate the response command buffer leaves the command buffer allocation unreleased. This affects all Linux kernel versions containing the vulnerable staging driver code and can be exploited by local attackers with low privileges to cause a denial of service through memory exhaustion. The vulnerability has a vendor-provided patch available across multiple stable kernel branches, and the EPSS score of 0.01% indicates minimal real-world exploitation probability despite the moderate CVSS 5.5 rating.
Technical Context
The vulnerability resides in the Linux kernel staging driver for the RTL8723BS WiFi adapter (cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*). Specifically, the rtw_init_cmd_priv() function in the RTL8723BS driver performs sequential allocations of command buffers without proper cleanup on partial failure. The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), a resource management defect where allocated memory is not freed when an error occurs during initialization. The vulnerable code path allocates pcmdpriv->cmd_allocated_buf first, then attempts to allocate pcmdpriv->rsp_allocated_buf; if the second allocation fails, the first allocation is never released, causing a permanent memory leak. This is a staging driver (experimental/development code), meaning it affects systems running kernel builds that include staging drivers.
Affected Products
The Linux kernel in all versions containing the rtl8723bs staging WiFi driver are affected, as indicated by the CPE identifiers (cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*). The vulnerability specifically impacts systems where the RTL8723BS driver is compiled into the kernel or loaded as a module. Patches are available from the Linux kernel stable releases via multiple commits: 39bef9c6a91bbb790d04c1347cfeae584541fb6a, 708056fba733a73d926772ea4ce9a42d240345da, 8db6ca84eee0ac258706f3fca54f7c021cb159ef, a5be64ff6d21f7805a91e6d81f53fc19cd9f0fae, e5d8f05edb36fc4ab15beec62cb6ab62f5a60fe2, and e6cc39db24a63f68314473621020ed8cad7be423 across various stable kernel branches. Upstream patches can be found at https://git.kernel.org/stable/ using the commit hashes provided.
Remediation
Apply the upstream Linux kernel patch to rtw_init_cmd_priv() which adds proper resource cleanup with kfree(pcmdpriv->cmd_allocated_buf) on the error path and simplifies the error handling logic. Users should upgrade to a kernel version that includes one of the six published patches across stable branches (check your distribution's kernel update advisories for the specific version). For systems unable to patch immediately, disable the rtl8723bs driver if the hardware is not in use, or use kernel module loading restrictions to prevent the vulnerable code path from executing. Most modern distributions default to not loading staging drivers, so risk may be minimal unless explicitly enabled or using specialized kernels.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today