Memory Leak in thermal/core Package
Summary
GSD-2022-1002749: thermal/core: Fix memory leak in __thermal_cooling_device_register(). Affects Kernel versions >= 8ea229511e06f9635ecc338dcbe0db41a73623f0, < 9abdf0c0184230f0cb5c6685aabf33dda89aa9fb. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The thermal/core package is a component of the Linux Kernel that manages thermal cooling devices. It provides an interface for registering and controlling cooling devices to prevent overheating of hardware components. The package is responsible for monitoring temperature sensors and adjusting cooling mechanisms accordingly. However, a vulnerability has been identified in the package that can lead to a memory leak.
Vulnerability Detail
The vulnerability, identified as GSD-2022-1002749, exists in the __thermal_cooling_device_register() function of the thermal/core package. When a cooling device is registered, memory is allocated for its data structure. However, due to a coding error, this memory is not properly freed when the device is unregistered. As a result, a memory leak occurs, leading to a gradual depletion of available memory resources. This can potentially cause system instability or even denial of service if the memory exhaustion reaches critical levels.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can manually free the memory allocated for cooling devices by modifying the code in the __thermal_cooling_device_unregister() function. The following code snippet demonstrates the necessary modification:
void __thermal_cooling_device_unregister(struct thermal_cooling_device *cdev)
{
// Existing code
...
// Add deallocation of memory
kfree(cdev);
}
Conclusion
In conclusion, the thermal/core package in the Linux Kernel is vulnerable to a memory leak issue. This vulnerability can lead to memory exhaustion and system instability. To mitigate the risk, it is recommended to update the kernel to version v5.18.3 or later. Alternatively, a workaround is available by modifying the __thermal_cooling_device_unregister() function to manually deallocate memory. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a memory leak, gradually depleting available memory resources. This can result in system instability or denial of service if memory exhaustion reaches critical levels.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this memory leak in the thermal/core package.
Yes, a patch for this vulnerability is available in the Linux Kernel version v5.18.3. It is recommended to update to this version or a later one to fix the memory leak issue.
While updating the kernel is the recommended solution, you can apply the provided workaround by modifying the __thermal_cooling_device_unregister() function to manually deallocate memory. However, it is still advisable to update the kernel to ensure a comprehensive fix.
There are no known instances of this vulnerability being exploited in the wild. However, it is essential to address the issue promptly to prevent any potential memory exhaustion and system instability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
