Vulnerability in cpufreq: schedutil in Linux Kernel
Summary
GSD-2021-1001515: cpufreq: schedutil: Use kobject release() method to free sugov_tunables. Affects Kernel versions >= 9bdcb44e391da5c41b98573bf0305a0e0b1c9569, < cb4a53ba37532c861a5f3f22803391018a41849a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cpufreq package in the Linux Kernel is responsible for managing the frequency scaling of the CPU. It provides various governors to control the CPU frequency based on system load and power management requirements. One of these governors is schedutil, which dynamically adjusts the CPU frequency based on the CPU utilization. This vulnerability affects the schedutil governor and its associated tunables.
Vulnerability Detail
The vulnerability in cpufreq: schedutil arises from the improper handling of memory allocation and deallocation. Specifically, the schedutil governor does not use the kobject release() method to free the sugov_tunables structure, leading to a potential memory leak. An attacker could potentially exploit this vulnerability to exhaust system memory resources, resulting in a denial-of-service condition. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in cpufreq: schedutil in the Linux Kernel can potentially result in a denial-of-service condition. It is recommended to update the Linux Kernel to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
Cpufreq is a package in the Linux Kernel that manages the frequency scaling of the CPU, allowing for dynamic adjustment of CPU frequency based on system load and power management requirements.
The schedutil governor is one of the CPU frequency scaling governors provided by cpufreq. It dynamically adjusts the CPU frequency based on the CPU utilization.
The impact of this vulnerability is not yet proven. However, it could potentially lead to a denial-of-service condition by exhausting system memory resources.
To fix this vulnerability, update the Linux Kernel to version v4.9.285 or later.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
