CVE-2023-52643: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-52643 is a memory leak vulnerability discovered in the Linux kernel's Industrial I/O (IIO) core subsystem. The issue specifically occurs in the iio_device_register_sysfs function when iio_device_register_sysfs_group() fails, where the system fails to properly free iio_dev_opaque->chan_attr_group.attrs, potentially leading to memory leaks (Red Hat Portal).

The vulnerability is classified with a CVSS v3.1 base score of 4.4 (Low severity) according to Red Hat's assessment. The vulnerability stems from a failure to properly handle memory deallocation in the IIO core subsystem. The technical issue traces back to the commit 32f171724e5c which introduced the IIO device group creation functionality. The vulnerability requires local access and high privileges to exploit (Red Hat Portal).

The primary impact of this vulnerability is related to system resource management, specifically memory resources. According to Red Hat's CVSS scoring, the vulnerability has high confidentiality impact but no integrity or availability impact. The memory leak could potentially lead to resource exhaustion over time if repeatedly triggered (Red Hat Portal).

The vulnerability requires local access and high privileges to exploit, making it relatively difficult to take advantage of in most scenarios. The attack complexity is rated as low, but the high privilege requirement serves as a significant barrier to exploitation (Red Hat Portal).

A fix has been implemented in the Linux kernel that properly frees iio_dev_opaque->chan_attr_group.attrs when iio_device_register_sysfs_group() fails. The patch adds proper memory cleanup in the error handling path (Kernel Git).