CVE-2023-3317

What it actually does

Use-after-free in mt7921_check_offload_capability after 'features' memory is released, enabling kernel crash or information leak.

Why it matters to the business

Local users can trigger system instability or expose sensitive kernel data, increasing downtime and confidentiality risks on affected wireless hardware.

How an attack unfolds

A local attacker loads the mt7921 driver, forces the offload capability check after memory release, and reuses the freed pointer to crash the kernel or read residual data.

How to fix it

Apply the fix in commit 939801c545ff382d762e5d2e9282824398afe779 for the affected component; rebuild and deploy updated kernel modules or packages containing the corrected mt7921 init logic.

How to confirm the fix worked

Confirm the patched commit is present in drivers/net/wireless/mediatek/mt76/mt7921/init.c, test that mt7921_check_offload_capability no longer accesses released memory, and verify no crash or leak under capability check workloads.

Typical attack path

1. Obtain local user access on a Linux system with mt7921 wireless hardware
2. Trigger wireless driver initialization or capability checks
3. Cause 'features' memory to be freed while still referenced
4. Reuse dangling pointer to induce crash or leak kernel memory

How to detect it

Review kernel logs for mt7921 oops, use-after-free warnings, or capability check failures; inspect wireless driver load events around crash times.

• mt7921_check_offload_capability
• use-after-free.*mt7921
• features.*release.*mt76

What your security team should do

• Prioritize patching systems with mt7921 hardware within standard change windows
• Monitor kernel logs for use-after-free warnings or mt7921 oops
• Restrict local access on multi-user systems until fixed