In the Linux kernel, the following vulnerability has been resolved:
mlxsw: thermal: Fix out-of-bounds memory accesses
Currently, mlxsw allows cooling states to be set above the maximum cooling state supported by the driver:
# cat /sys/class/thermal/thermal_zone2/cdev0/type mlxsw_fan # cat /sys/class/thermal/thermal_zone2/cdev0/max_state 10 # echo 18 > /sys/class/thermal/thermal_zone2/cdev0/cur_state # echo $? 0
This results in out-of-bounds memory accesses when thermal state transition statistics are enabled (CONFIG_THERMAL_STATISTICS=y), as the transition table is accessed with a too large index (state) [1].
According to the thermal maintainer, it is the responsibility of the driver to reject such operations [2].
Therefore, return an error when the state to be set exceeds the maximum cooling state supported by the driver.
To avoid dead code, as suggested by the thermal maintainer [3], partially revert commit a421ce088ac8 ("mlxsw: core: Extend cooling device with cooling levels") that tried to interpret these invalid cooling states (above the maximum) in a special way. The cooling levels array is not removed in order to prevent the fans going below 20% PWM, which would cause them to get stuck at 0% PWM.
[1] BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x271/0x290 Read of size 4 at addr ffff8881052f7bf8 by task kworker/0:0/5
CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.15.0-rc3-custom-45935-gce1adf704b14 #122 Hardware name: Mellanox Technologies Ltd. "MSN2410-CB2FO"/"SA000874", BIOS 4.6.5 03/08/2016 Workqueue: events_freezable_power_ thermal_zone_device_check Call Trace: dump_stack_lvl+0x8b/0xb3 print_address_description.constprop.0+0x1f/0x140 kasan_report.cold+0x7f/0x11b thermal_cooling_device_stats_update+0x271/0x290 __thermal_cdev_update+0x15e/0x4e0 thermal_cdev_update+0x9f/0xe0 step_wise_throttle+0x770/0xee0 thermal_zone_device_update+0x3f6/0xdf0 process_one_work+0xa42/0x1770 worker_thread+0x62f/0x13e0 kthread+0x3ee/0x4e0 ret_from_fork+0x1f/0x30
Allocated by task 1: kasan_save_stack+0x1b/0x40 __kasan_kmalloc+0x7c/0x90 thermal_cooling_device_setup_sysfs+0x153/0x2c0 __thermal_cooling_device_register.part.0+0x25b/0x9c0 thermal_cooling_device_register+0xb3/0x100 mlxsw_thermal_init+0x5c5/0x7e0 __mlxsw_core_bus_device_register+0xcb3/0x19c0 mlxsw_core_bus_device_register+0x56/0xb0 mlxsw_pci_probe+0x54f/0x710 local_pci_probe+0xc6/0x170 pci_device_probe+0x2b2/0x4d0 really_probe+0x293/0xd10 __driver_probe_device+0x2af/0x440 driver_probe_device+0x51/0x1e0 __driver_attach+0x21b/0x530 bus_for_each_dev+0x14c/0x1d0 bus_add_driver+0x3ac/0x650 driver_register+0x241/0x3d0 mlxsw_sp_module_init+0xa2/0x174 do_one_initcall+0xee/0x5f0 kernel_init_freeable+0x45a/0x4de kernel_init+0x1f/0x210 ret_from_fork+0x1f/0x30
The buggy address belongs to the object at ffff8881052f7800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 1016 bytes inside of 1024-byte region [ffff8881052f7800, ffff8881052f7c00) The buggy address belongs to the page: page:0000000052355272 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1052f0 head:0000000052355272 order:3 compound_mapcount:0 compound_pincount:0 flags: 0x200000000010200(slab|head|node=0|zone=2) raw: 0200000000010200 ffffea0005034800 0000000300000003 ffff888100041dc0 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected
Memory state around the buggy address: ffff8881052f7a80: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc ffff8881052f7b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8881052f7b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff8881052f7c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8881052f7c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[2] https://lore.kernel.org/linux-pm/9aca37cb-1629-5c67- ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rtUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-extraUpgrade python3-perfUpgrade perfUpgrade kernelUpgrade bpftoolUpgrade kernel-rt-kvmUpgrade kernel-toolsUpgrade kernel-zfcpdump-coreUpgrade kernel-abi-stablelistsUpgrade kernel-cross-headersUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdumpUpgrade kernel-debug-modulesUpgrade kernel-debugUpgrade kernel-tools-libsUpgrade kernel-modulesUpgrade kernel-debug-develUpgrade kernel-modules-extraUpgrade kernel-rt-develUpgrade kernel-rt-debugUpgrade kernel-debug-modules-extraUpgrade kernel-docUpgrade kernel-develUpgrade kernel-headersUpgrade kernel-coreUpgrade kernel-rt-coreUpgrade kernel-rt-debug-develUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-devel | Sep 26, 2024 | May 22, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 22, 2024 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | May 22, 2024 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Sep 25, 2024 | May 22, 2024 |
| Rocky_linux | — | Upgrade kernel-tools-libs-develUpgrade kernel-rt-coreUpgrade perfUpgrade kernelUpgrade kernel-rt-debug-kvmUpgrade kernel-debuginfoUpgrade kernel-rt-modules-extraUpgrade python3-perfUpgrade perf-debuginfoUpgrade kernel-debugUpgrade kernel-cross-headersUpgrade kernel-debug-develUpgrade kernel-develUpgrade kernel-rt-debugUpgrade kernel-modules-extraUpgrade kernel-debug-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-rt-develUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-modulesUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-rt-debug-develUpgrade kernel-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-libsUpgrade kernel-rt-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-coreUpgrade kernel-rt-modulesUpgrade kernel-rtUpgrade kernel-debug-modules-extraUpgrade kernel-toolsUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-coreUpgrade kernel-rt-debug-coreUpgrade kernel-headersUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-debuginfo | Oct 2, 2024 | May 22, 2024 |
| Suse | — | Upgrade dtb-lgUpgrade kernel-default-vdsoUpgrade kernel-rt-vdsoUpgrade gfs2-kmp-azureUpgrade kernel-default-livepatch-develUpgrade dtb-alteraUpgrade dtb-nvidiaUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-socionextUpgrade kernel-azure-develUpgrade dtb-freescaleUpgrade ocfs2-kmp-defaultUpgrade dtb-qcomUpgrade kernel-rtUpgrade kernel-azure-vdsoUpgrade kernel-rt-optionalUpgrade kernel-docs-htmlUpgrade ocfs2-kmp-64kbUpgrade dlm-kmp-64kbUpgrade dtb-broadcomUpgrade kernel-rt-livepatch-develUpgrade kernel-azureUpgrade kselftests-kmp-64kbUpgrade dtb-sprdUpgrade dtb-marvellUpgrade kernel-source-rtUpgrade kernel-rt_debug-develUpgrade kernel-default-baseUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt-extraUpgrade kernel-kvmsmall-vdsoUpgrade kernel-64kb-extraUpgrade kselftests-kmp-azureUpgrade dtb-allwinnerUpgrade dtb-rockchipUpgrade cluster-md-kmp-64kbUpgrade gfs2-kmp-defaultUpgrade kernel-rt_debugUpgrade kernel-default-base-rebuildUpgrade kernel-source-azureUpgrade dtb-caviumUpgrade kernel-preemptUpgrade dtb-exynosUpgrade kernel-azure-extraUpgrade reiserfs-kmp-64kbUpgrade kernel-preempt-develUpgrade dlm-kmp-rtUpgrade kernel-obs-buildUpgrade kernel-defaultUpgrade kernel-azure-optionalUpgrade kernel-default-livepatchUpgrade kernel-debug-vdsoUpgrade kernel-source-vanillaUpgrade dtb-appleUpgrade kernel-64kbUpgrade kernel-develUpgrade kernel-debug-develUpgrade dlm-kmp-defaultUpgrade gfs2-kmp-64kbUpgrade kernel-rt-livepatchUpgrade kernel-sourceUpgrade kselftests-kmp-defaultUpgrade kernel-64kb-optionalUpgrade reiserfs-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-kvmsmallUpgrade kernel-syms-azureUpgrade dtb-armUpgrade ocfs2-kmp-azureUpgrade kernel-debugUpgrade kernel-syms-rtUpgrade reiserfs-kmp-defaultUpgrade kernel-devel-azureUpgrade kernel-docsUpgrade kernel-obs-qaUpgrade dtb-mediatekUpgrade ocfs2-kmp-rtUpgrade kernel-kvmsmall-develUpgrade dtb-hisiliconUpgrade dtb-amazonUpgrade dlm-kmp-azureUpgrade kernel-64kb-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-livepatch-develUpgrade kernel-devel-rtUpgrade gfs2-kmp-rtUpgrade dtb-amdUpgrade cluster-md-kmp-rtUpgrade dtb-amlogicUpgrade kernel-rt-develUpgrade kernel-zfcpdumpUpgrade kernel-default-develUpgrade kernel-default-extraUpgrade dtb-xilinxUpgrade cluster-md-kmp-azureUpgrade kernel-symsUpgrade kernel-64kb-develUpgrade kernel-macrosUpgrade dtb-apmUpgrade kernel-rt_debug-vdsoUpgrade kernel-default-optionalUpgrade kselftests-kmp-rtUpgrade reiserfs-kmp-rtUpgrade dtb-renesas | Aug 9, 2024 | May 22, 2024 |
| Ubuntu | — | Upgrade linux-awsUpgrade linux-gcpUpgrade linux-fipsUpgrade linux-oracleUpgrade linux-kvmUpgrade linux-aws-fipsUpgrade linux-ibmUpgrade linux-gcp-5.4Upgrade linuxUpgrade linux-azure-5.4Upgrade linux-aws-5.4Upgrade linux-oracle-5.4Upgrade linux-gkeopUpgrade linux-raspiUpgrade linux-azure-fipsUpgrade linux-bluefieldUpgrade linux-azureUpgrade linux-gcp-fipsUpgrade linux-hwe-5.4Upgrade linux-raspi-5.4 | Nov 19, 2024 | May 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub