CVE-2023-52643

What it actually does

Memory leak occurs in the IIO subsystem when iio_device_register_sysfs_group fails, leaving the chan_attr_group.attrs array unfreed and causing gradual memory consumption.

Why it matters to the business

Systems using IIO devices may experience gradual memory exhaustion leading to reduced stability or crashes during prolonged operation, with urgency low due to local-only access requirement and absence from known exploitation campaigns.

How an attack unfolds

An attacker with local access triggers repeated failures in sysfs group registration for IIO devices to accumulate unfreed memory allocations until system resources are depleted.

How to fix it

Update the Linux kernel to a version containing commit 1c6d19c8cbf6abcea2c8fca2db26abca2cbf0363 or later; rebuild and deploy the updated kernel image across affected systems.

How to confirm the fix worked

Verify the running kernel source contains commit 1c6d19c8cbf6abcea2c8fca2db26abca2cbf0363; inspect IIO registration code paths for the added free of chan_attr_group.attrs on failure.

Typical attack path

1. Obtain local access to a system running a vulnerable Linux kernel with IIO support
2. Trigger IIO device registration paths that cause iio_device_register_sysfs_group to fail
3. Repeat the triggering condition to accumulate leaked memory allocations
4. Monitor for system instability or out-of-memory conditions

How to detect it

Review kernel memory allocator logs and IIO device registration traces for repeated allocation patterns without corresponding frees; correlate with device addition events in dmesg or system logs.

What your security team should do

• Apply the kernel fix containing commit 1c6d19c8cbf6abcea2c8fca2db26abca2cbf0363 as soon as possible on systems exposing IIO devices
• Monitor memory usage trends on IIO-enabled hosts until patches are deployed
• Review device driver configurations to minimize unnecessary IIO sysfs exposure