LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54252: platform/x86: think-lmi: Fix memory leaks when parsing ThinkStation WMI strings

In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Fix memory leaks when parsing ThinkStation WMI strings My previous commit introduced a memory leak where the item allocated from tlmi_setting was not freed. This commit also renames it to avoid confusion with the similarly name variable in the same function.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2023-54252 is a Linux kernel issue where ThinkStation WMI string parsing in the think-lmi platform driver could leak memory. The public record does not provide CVSS, exploitability, or a clear attacker path. Treat it as a kernel maintenance exposure until vendor guidance clarifies impact.

Executive priority

Monitor and patch during normal kernel maintenance unless internal exposure analysis shows broad ThinkStation WMI usage. There is not enough public evidence to justify emergency action.

Technical view

The source describes a memory leak introduced by an earlier Linux kernel change in platform/x86 think-lmi. A tlmi_setting allocation was not freed while parsing ThinkStation WMI strings. Stable kernel commits are listed as references, but the record does not provide CWE, CVSS, privileges required, or triggerability details.

Likely exposure

Likely limited to Linux kernels containing the affected think-lmi code path, especially systems where ThinkStation WMI/LMI functionality is present. The source bundle does not provide complete affected version ranges or distribution package mappings.

Exploitation context

No CISA KEV listing is present, and the provided sources do not cite active exploitation or public exploit use. The available evidence only supports a memory-leak characterization, not a confirmed remote, local, or privilege-escalation scenario.

Researcher notes

The record is sparse: no CVSS, CWE, attack vector, or detailed affected ranges are supplied. Analysis should focus on commit ancestry, distro backports, and whether reachable WMI parsing paths can be exercised in realistic configurations.

Mitigation direction

  • Check Linux distribution advisories for packages including the referenced stable fixes.
  • Update affected Linux kernel packages through normal vendor-supported channels.
  • Prioritize systems using Lenovo ThinkStation WMI/LMI functionality.
  • Track the CVE record for clarified severity, affected ranges, and distro mappings.

Validation and detection

  • Compare running kernel package changelogs against the referenced stable commits.
  • Confirm whether the think-lmi driver is present or relevant on assessed systems.
  • Verify vendor advisories for corrected package versions before closure.
  • Document uncertainty where affected version mapping is unavailable.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54252 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxdae47bf0222e1e0eb6684c7e141b7170b0884a4c, f0a67ad7dce49d93570edc795e0312bb787f19bb, c9c542eba4edf8d061bd2e5007cf598625e112df, 8a02d70679fc1c434401863333c8ea7dbf201494unaffected
LinuxLinux5.15.106, 6.1.23, 6.2.10unaffected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.