Memory Leak Vulnerability in Linux Kernel Affecting IMXRT1050 Clocks

CVE-2023-53264

What is CVE-2023-53264?

The Linux kernel has identified and resolved a critical memory leak vulnerability in the IMXRT1050 clock driver, specifically within the clk-imxrt1050 module. The issue arises from improper handling of memory allocation, where errors during the mapping of I/O regions can lead to allocated memory not being freed. This situation can result in a memory leak if not managed properly. To address this, developers are advised to utilize the devm_of_iomap() function instead of of_iomap(), which ensures automated freeing of memory. Additionally, enhanced error handling has been introduced to better manage hardware state registrations when I/O mapping fails, including a newly added unregister_hws label to ensure clean-up processes are executed properly.

References