In the Linux kernel, the following vulnerability has been resolved:
hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs
Fan speed minimum can be enforced from sysfs. For example, setting current fan speed to 20 is used to enforce fan speed to be at 100% speed, 19 - to be not below 90% speed, etcetera. This feature provides ability to limit fan speed according to some system wise considerations, like absence of some replaceable units or high system ambient temperature.
Request for changing fan minimum speed is configuration request and can be set only through 'sysfs' write procedure. In this situation value of argument 'state' is above nominal fan speed maximum.
Return non-zero code in this case to avoid thermal_cooling_device_stats_update() call, because in this case statistics update violates thermal statistics table range. The issues is observed in case kernel is configured with option CONFIG_THERMAL_STATISTICS.
Here is the trace from KASAN: [ 159.506659] BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x7d/0xb0 [ 159.516016] Read of size 4 at addr ffff888116163840 by task hw-management.s/7444 [ 159.545625] Call Trace: [ 159.548366] dump_stack+0x92/0xc1 [ 159.552084] ? thermal_cooling_device_stats_update+0x7d/0xb0 [ 159.635869] thermal_zone_device_update+0x345/0x780 [ 159.688711] thermal_zone_device_set_mode+0x7d/0xc0 [ 159.694174] mlxsw_thermal_modules_init+0x48f/0x590 [mlxsw_core] [ 159.700972] ? mlxsw_thermal_set_cur_state+0x5a0/0x5a0 [mlxsw_core] [ 159.731827] mlxsw_thermal_init+0x763/0x880 [mlxsw_core] [ 160.070233] RIP: 0033:0x7fd995909970 [ 160.074239] Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff .. [ 160.095242] RSP: 002b:00007fff54f5d938 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 160.103722] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00007fd995909970 [ 160.111710] RDX: 0000000000000013 RSI: 0000000001906008 RDI: 0000000000000001 [ 160.119699] RBP: 0000000001906008 R08: 00007fd995bc9760 R09: 00007fd996210700 [ 160.127687] R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000013 [ 160.135673] R13: 0000000000000001 R14: 00007fd995bc8600 R15: 0000000000000013 [ 160.143671] [ 160.145338] Allocated by task 2924: [ 160.149242] kasan_save_stack+0x19/0x40 [ 160.153541] __kasan_kmalloc+0x7f/0xa0 [ 160.157743] __kmalloc+0x1a2/0x2b0 [ 160.161552] thermal_cooling_device_setup_sysfs+0xf9/0x1a0 [ 160.167687] __thermal_cooling_device_register+0x1b5/0x500 [ 160.173833] devm_thermal_of_cooling_device_register+0x60/0xa0 [ 160.180356] mlxreg_fan_probe+0x474/0x5e0 [mlxreg_fan] [ 160.248140] [ 160.249807] The buggy address belongs to the object at ffff888116163400 [ 160.249807] which belongs to the cache kmalloc-1k of size 1024 [ 160.263814] The buggy address is located 64 bytes to the right of [ 160.263814] 1024-byte region [ffff888116163400, ffff888116163800) [ 160.277536] The buggy address belongs to the page: [ 160.282898] page:0000000012275840 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888116167000 pfn:0x116160 [ 160.294872] head:0000000012275840 order:3 compound_mapcount:0 compound_pincount:0 [ 160.303251] flags: 0x200000000010200(slab|head|node=0|zone=2) [ 160.309694] raw: 0200000000010200 ffffea00046f7208 ffffea0004928208 ffff88810004dbc0 [ 160.318367] raw: ffff888116167000 00000000000a0006 00000001ffffffff 0000000000000000 [ 160.327033] page dumped because: kasan: bad access detected [ 160.333270] [ 160.334937] Memory state around the buggy address: [ 160.356469] >ffff888116163800: fc ..
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-headersUpgrade kernel-rt-debug-develUpgrade kernel-tools-libsUpgrade kernel-zfcpdumpUpgrade kernel-rt-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-coreUpgrade kernel-rt-develUpgrade kernel-rt-debug-modulesUpgrade kernel-modules-extraUpgrade kernelUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-docUpgrade kernel-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade perfUpgrade kernel-zfcpdump-develUpgrade kernel-modulesUpgrade python3-perfUpgrade kernel-develUpgrade kernel-coreUpgrade kernel-rt-debugUpgrade kernel-debugUpgrade kernel-rtUpgrade bpftoolUpgrade kernel-cross-headersUpgrade kernel-rt-modulesUpgrade kernel-toolsUpgrade kernel-rt-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-extraUpgrade kernel-rt-kvmUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-abi-stablelists | Sep 26, 2024 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | May 21, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Sep 25, 2024 | May 21, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debug-coreUpgrade kernel-tools-libs-develUpgrade kernel-rt-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-rt-develUpgrade kernel-rt-modules-extraUpgrade kernel-rtUpgrade kernel-tools-libsUpgrade kernel-rt-debuginfo-common-x86_64Upgrade python3-perf-debuginfoUpgrade kernelUpgrade bpftoolUpgrade kernel-rt-debugUpgrade kernel-debug-modulesUpgrade kernel-cross-headersUpgrade kernel-develUpgrade kernel-rt-kvmUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-coreUpgrade kernel-debug-coreUpgrade python3-perfUpgrade perfUpgrade kernel-debuginfoUpgrade kernel-coreUpgrade kernel-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-modulesUpgrade kernel-debugUpgrade kernel-debug-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-debug-develUpgrade kernel-headers | Oct 2, 2024 | May 21, 2024 |
| Suse | — | Upgrade gfs2-kmp-64kbUpgrade kernel-rtUpgrade kernel-azure-extraUpgrade kernel-zfcpdumpUpgrade kernel-rt-optionalUpgrade cluster-md-kmp-rtUpgrade dtb-qcomUpgrade kselftests-kmp-64kbUpgrade dlm-kmp-64kbUpgrade kernel-rt-vdsoUpgrade ocfs2-kmp-azureUpgrade kernel-rt_debug-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-64kbUpgrade dtb-marvellUpgrade kernel-rt-livepatchUpgrade dtb-xilinxUpgrade dtb-lgUpgrade kernel-devel-azureUpgrade kernel-default-optionalUpgrade kernel-docs-htmlUpgrade kernel-64kb-optionalUpgrade gfs2-kmp-defaultUpgrade dtb-broadcomUpgrade dtb-allwinnerUpgrade gfs2-kmp-rtUpgrade reiserfs-kmp-64kbUpgrade kernel-debug-vdsoUpgrade kernel-preemptUpgrade kernel-azure-optionalUpgrade dtb-caviumUpgrade gfs2-kmp-azureUpgrade kernel-azure-livepatch-develUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-kvmsmallUpgrade kernel-azure-develUpgrade kselftests-kmp-azureUpgrade dtb-hisiliconUpgrade kernel-source-rtUpgrade kernel-source-vanillaUpgrade kernel-sourceUpgrade kernel-source-azureUpgrade kernel-kvmsmall-develUpgrade dtb-freescaleUpgrade kernel-64kb-livepatch-develUpgrade dtb-amazonUpgrade kernel-debugUpgrade kernel-syms-azureUpgrade kernel-default-vdsoUpgrade kernel-default-develUpgrade kernel-default-livepatchUpgrade kernel-azureUpgrade cluster-md-kmp-azureUpgrade kernel-develUpgrade ocfs2-kmp-64kbUpgrade kernel-preempt-develUpgrade ocfs2-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade dtb-appleUpgrade dtb-alteraUpgrade dtb-exynosUpgrade kernel-rt-livepatch-develUpgrade kernel-default-livepatch-develUpgrade dtb-apmUpgrade dlm-kmp-azureUpgrade reiserfs-kmp-rtUpgrade kselftests-kmp-defaultUpgrade dtb-renesasUpgrade kernel-symsUpgrade kernel-obs-buildUpgrade dtb-armUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-rockchipUpgrade kernel-rt-develUpgrade dtb-amdUpgrade kernel-macrosUpgrade dtb-nvidiaUpgrade kernel-default-base-rebuildUpgrade cluster-md-kmp-64kbUpgrade kernel-defaultUpgrade kselftests-kmp-rtUpgrade kernel-rt_debugUpgrade dlm-kmp-rtUpgrade kernel-rt-extraUpgrade kernel-default-extraUpgrade kernel-syms-rtUpgrade dlm-kmp-defaultUpgrade kernel-obs-qaUpgrade kernel-docsUpgrade reiserfs-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade dtb-sprdUpgrade kernel-debug-livepatch-develUpgrade dtb-mediatekUpgrade kernel-64kb-extraUpgrade kernel-devel-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-default-baseUpgrade dtb-amlogicUpgrade cluster-md-kmp-defaultUpgrade kernel-debug-develUpgrade kernel-azure-vdsoUpgrade dtb-socionextUpgrade kernel-64kb-devel | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-raspiUpgrade linux-oracleUpgrade linuxUpgrade linux-oracle-5.4Upgrade linux-azureUpgrade linux-aws-5.4Upgrade linux-fipsUpgrade linux-azure-fipsUpgrade linux-gkeopUpgrade linux-gcpUpgrade linux-azure-5.4Upgrade linux-hwe-5.4Upgrade linux-awsUpgrade linux-kvmUpgrade linux-bluefieldUpgrade linux-raspi-5.4Upgrade linux-gcp-fipsUpgrade linux-gcp-5.4Upgrade linux-ibmUpgrade linux-aws-fips | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub