Potential NULL dereference in sr_thermal_probe in thermal/drivers/broadcom
Summary
GSD-2022-1003772: thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe. Affects Kernel versions >= 250e211057c7237dc75634b1372a1a3bd58dcd96, < b3461ccaa5d2588568d865faee285512ad448049. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The thermal/drivers/broadcom package is a part of the Linux Kernel ecosystem. It provides support for thermal management on Broadcom devices. The sr_thermal_probe function is responsible for probing and initializing the thermal sensor on these devices.
Vulnerability Detail
A potential NULL dereference vulnerability has been identified in the sr_thermal_probe function. This vulnerability can be exploited by an attacker to cause a NULL pointer dereference, leading to a system crash or potential privilege escalation. The vulnerability was introduced in Linux Kernel version v5.1 and has been fixed in version v5.4.198 by commit b3461ccaa5d2588568d865faee285512ad448049.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.4.198 or later. This can be done by pulling the latest updates from the official Linux Kernel repository and rebuilding the kernel. Alternatively, users can wait for their Linux distribution to release an updated kernel package that includes the fix.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
In conclusion, a potential NULL dereference vulnerability has been identified in the sr_thermal_probe function in thermal/drivers/broadcom. This vulnerability can be fixed by updating the Linux Kernel to version v5.4.198 or later. It is recommended to take immediate action to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to a system crash or potential privilege escalation.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there is no known exploit for this vulnerability.
The recommended approach is to update the Linux Kernel to the fixed version. However, if updating is not immediately feasible, you can consider implementing additional security measures such as restricting access to the affected system or applying other relevant security patches.
You can find more information about this vulnerability in the vulnerability database maintained by the Cloud Security Alliance. The specific vulnerability ID is GSD-2022-1003772.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.