CVE-2023-52684

What it actually does

The vulnerability consists of direct error returns in qcom qseecom SCM call paths that bypass the labels responsible for freeing allocated memory buffers, resulting in leaks on every error condition encountered.

Why it matters to the business

Linux systems using Qualcomm firmware may experience gradual memory exhaustion during error scenarios, leading to degraded performance, instability, or forced restarts in long-running environments; the issue is limited to specific Qualcomm-dependent kernels and has low observed exploitation likelihood.

How an attack unfolds

An attacker with the ability to trigger repeated error conditions in the qseecom SCM interface (for example through malformed or failing secure calls) causes the driver to leak memory on each invocation without ever reaching the cleanup labels; over time this depletes available RAM and can induce denial-of-service conditions on affected devices.

How to fix it

Upgrade the Linux kernel to a fixed release such as 6.7.2 or later, or apply the commit 85fdbf6840455be64eac16bdfe0df3368ee3d0f0 (and equivalent backports) that routes all error paths through the proper memory-freeing labels.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or is at version 6.7.2 or newer; inspect the qseecom source to verify that error returns now jump to the cleanup labels instead of returning directly.

Typical attack path

1. Identify hosts running vulnerable Linux kernel versions with Qualcomm qseecom support
2. Craft inputs or workloads that force the qseecom driver into error paths during SCM operations
3. Repeat triggering of those error conditions to accumulate unfreed allocations
4. Observe system memory pressure or OOM events resulting from sustained leaks

How to detect it

Examine kernel logs and process memory statistics for repeated qseecom-related allocations that are never released; correlate with error paths in SCM call sequences and watch for gradual increases in kernel memory usage on Qualcomm hardware.

What your security team should do

• Apply the kernel update to 6.7.2 or the listed commit on all Qualcomm-based systems as the primary remediation
• Review kernel changelogs for backported fixes in currently deployed stable branches
• Monitor memory usage trends on affected devices for unexpected growth correlated with qseecom activity
• Prioritize patching on internet-facing or high-uptime systems even though exploitation maturity remains low