CVE-2021-47570

What it actually does

A memory leak occurs in the rtw_wx_read32 function when an invalid argument triggers an early return of -EINVAL without freeing the allocated ptmp buffer.

Why it matters to the business

Repeated triggering of the affected code path can exhaust kernel memory, leading to performance degradation or denial of service on systems using the vulnerable wireless driver; the issue has been public for over two years with no observed exploitation.

How an attack unfolds

An attacker with local access invokes the wireless extension handler with crafted invalid parameters to reach the error path in rtw_wx_read32, leaking memory on each call; the low-complexity local vector allows repeated triggering without elevated privileges beyond normal user access.

How to fix it

Apply the upstream fix that frees ptmp before returning -EINVAL; users of affected packages should upgrade to the commit db8645b21b86fe368938d53b202c1014a929ab45 or later equivalent.

How to confirm the fix worked

Confirm the presence of the memory-freeing statement before the -EINVAL return in rtw_wx_read32; test by exercising the read32 path with invalid arguments and monitoring for allocation leaks via kernel memory tools.

Typical attack path

1. Gain local user access to a system running the affected kernel driver
2. Locate and invoke the wireless extension ioctl path that calls rtw_wx_read32
3. Supply invalid arguments to force the early -EINVAL return
4. Repeat the call to accumulate leaked memory until resource exhaustion

How to detect it

Review kernel logs and memory usage trends for unexplained growth correlated with wireless extension ioctl activity; examine audit logs for repeated calls to the affected function from untrusted processes.

What your security team should do

• Prioritize patching systems that expose the r8188eu driver to local users
• Monitor for kernel memory pressure indicators on unpatched hosts
• Remove or disable the staging driver if the hardware is not required