CVE-2024-35828

What it actually does

Failure to free cmdarray and cmdarray[i].cmdbuf on allocation error in lbs_allocate_cmd_buffer() causes kernel memory leaks.

Why it matters to the business

Repeated triggering of the error path can exhaust memory on affected wireless systems, leading to degraded performance or crashes that disrupt operations.

How an attack unfolds

A local attacker with the ability to exercise the libertas driver command buffer allocation repeatedly triggers allocation failures, leaving unreleased memory buffers that accumulate until the system becomes unstable.

How to fix it

Apply the upstream kernel fix that properly frees both cmdarray and cmdarray[i].cmdbuf on allocation failure; update to a kernel containing the resolution for CVE-2024-35828.

How to confirm the fix worked

Confirm the patched lbs_allocate_cmd_buffer() implementation contains the additional kfree calls on the failure path; review kernel memory usage statistics before and after exercising the allocation routine.

Typical attack path

1. Obtain local access to a system using the vulnerable libertas wifi driver
2. Trigger repeated calls to lbs_allocate_cmd_buffer() under conditions that cause cmdbuf allocation to fail
3. Allow leaked memory to accumulate until resource exhaustion occurs

How to detect it

Review kernel logs for repeated allocation failures inside lbs_allocate_cmd_buffer and correlate with unexplained increases in slab or kmalloc memory usage on systems exposing the libertas driver.

What your security team should do

• Prioritize patching wireless-enabled systems running the affected libertas driver
• Monitor for kernel memory pressure indicators on devices using this driver
• Restrict local user access where possible until patches are deployed