CVE-2024-53059

A flaw was found in the Linux kernel's Intel Wi-Fi driver (iwlwifi). This vulnerability allows a local user to cause a Denial of Service (DoS) or system instability through improper memory and buffer management. During firmware recovery operations, the driver fails to validate the response packet size and fails to free the allocated memory buffer, leading to resource leaks and crashes.

The bug could happen if Intel Wireless WiFi MVM Firmware being used and as result of hardware failure and malicious data during auto-recovery (IWL_MVM_STATUS_IN_HW_RESTART, iwl_mvm_send_recovery_cmd). The security impact is limited, because only local privileged user can trigger it.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module iwlmvm from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.