CVE-2024-27391

What it actually does

Repeated allocation of a single required workqueue each time a network interface is initialized over a phy, causing progressive leakage of kworker threads and associated kernel resources instead of reuse.

Why it matters to the business

Systems using the wilc1000 driver may experience gradual resource exhaustion and degraded stability when interfaces are frequently added or removed, increasing operational overhead especially on long-running or embedded Linux deployments.

How an attack unfolds

An attacker with local access or the ability to trigger interface creation/deletion (for example via iw commands or automated scripts) repeatedly adds and removes managed interfaces on phy0, causing the driver to allocate new workqueues each time and accumulate orphaned kworker threads until system resources are depleted.

How to fix it

Update the Linux kernel to a version containing commit 515cc676dfbce40d93c92b1ff3c1070e917f4e52 or later; rebuild and deploy the wilc1000 driver with workqueue allocation restored to wilc_cfg80211_init and name enrichment limited to the wiphy identifier.

How to confirm the fix worked

After patching, repeat the interface add/delete loop and confirm via ps that only a single kworker thread per phy remains; verify the workqueue name contains the wiphy identifier but does not accumulate across iterations.

Typical attack path

1. Obtain local execution or sufficient privileges to manage wireless interfaces
2. Repeatedly execute interface addition (iw phy phy0 interface add) followed by deletion
3. Observe accumulation of kworker/R-wlan* threads via ps or similar
4. Continue until kernel memory or process limits cause denial of service or instability

How to detect it

Inspect process listings and kernel logs for growing numbers of kworker/R-wlan* threads on systems with wilc1000 hardware; correlate with interface creation events in audit or system logs.

What your security team should do

• Prioritize patching kernel packages on any systems using the wilc1000 driver
• Monitor for excessive kworker threads on affected hardware
• Limit unprivileged interface management where feasible until updated kernels are deployed