Memory Leak in thermal/core Package
Summary
GSD-2022-1003347: thermal/core: Fix memory leak in __thermal_cooling_device_register(). Affects Kernel versions >= 8ea229511e06f9635ecc338dcbe0db41a73623f0, < 21ccc58b671aea924f2481cf5c1cf0ebbfd3552d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The thermal/core package is a component of the Linux Kernel that manages thermal cooling devices. These devices are responsible for regulating the temperature of various hardware components in a system. The package provides functionality for registering and controlling cooling devices. However, a vulnerability has been discovered in the package that leads to a memory leak when registering a thermal cooling device.
Vulnerability Detail
The vulnerability, identified as GSD-2022-1003347, originates from a memory leak in the __thermal_cooling_device_register() function within the thermal/core package. When this function is called to register a thermal cooling device, it fails to release allocated memory in certain scenarios. This can result in a gradual depletion of system memory, potentially leading to performance degradation or even system instability. The vulnerability was introduced in version v4.17 of the Linux Kernel and has been fixed in version v5.15.46.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to apply the patch by updating the Linux Kernel.
Conclusion
In conclusion, the thermal/core package in the Linux Kernel is vulnerable to a memory leak in the __thermal_cooling_device_register() function. This vulnerability can lead to memory depletion, performance degradation, or system instability. It is crucial to update the Linux Kernel to version v5.15.46 or later to address this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a memory leak, causing gradual depletion of system memory and potential performance degradation or system instability.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will alert you in real-time if the vulnerability is detected.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the recommended patch to mitigate the risk.
The recommended approach is to update the Linux Kernel to the fixed version. Manually fixing the memory leak without the patch may require in-depth knowledge of the codebase and could introduce other issues.
The primary solution is to update the Linux Kernel. However, if updating is not immediately feasible, implementing strict memory management practices and monitoring system resources can help mitigate the impact of the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
