Critical Vulnerability in Linux Kernel: Incorrect PTR_ERR() Judgment in Thermal Drivers
Summary
DEBIAN-CVE-2023-52613: In the Linux kernel, the following vulnerability has been resolved: drivers/thermal/loongson2_thermal: Fix incorrect PTR_ERR() judgment PTR_ERR() returns -ENODEV when thermal-zones are undefined, and we need -ENODEV as t... Affects linux versions < 6.6.15-1. Fixed in 6.6.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and extensive support for various hardware architectures. This vulnerability affects the thermal management subsystem, specifically in the loongson2_thermal driver, which is responsible for managing thermal zones in devices. The flaw arises from an incorrect judgment in the PTR_ERR() function, leading to potential system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the thermal management subsystem, specifically within the loongson2_thermal driver. The issue stems from an incorrect comparison of the return value from the PTR_ERR() function, which is supposed to indicate an error when thermal zones are undefined. Instead of handling the error correctly, the system may attempt to access a NULL pointer, resulting in a kernel panic and subsequent system crash. This vulnerability can lead to significant disruptions in system operations, particularly in environments where thermal management is critical.
How To Fix
Minimum fixed version
6.6.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the loongson2_thermal driver if it is not critical for their system's operation. This can be done by blacklisting the driver in the system configuration files, preventing it from loading at boot.
Conclusion
The identified vulnerability in the Linux kernel's thermal management subsystem poses a significant risk to system stability. Users are urged to update to the latest patched version to mitigate potential impacts. Temporary workarounds are available, but applying the update is the most effective solution.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to kernel panics and system crashes, affecting the stability and reliability of the operating system.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software by simply uploading your manifest file.
Yes, a patch is available in the form of the Linux kernel version 6.6.15-1 or later.
Consider disabling the loongson2_thermal driver as a temporary workaround until you can apply the update.
Detailed information can be found in the official Debian CVE database and on the Vulert platform.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
